PT-2018-4260 · Ntt+1 · Ntp+1

Publicado 2018-08-14 · Atualizado 2020-01-24 · CVE-2014-5209

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NTP version 4.2.7p25

Description The issue allows a malicious user to obtain sensitive information through private (mode 6/7) messages via a GET RESTRICT control message. Additionally, a remote authenticated attacker could bypass security restrictions by creating multiple ephemeral associations to win the clock selection of ntpd, potentially modifying a victim's clock.

Recommendations For NTP version 4.2.7p25, consider restricting access to the GET RESTRICT control message to prevent information disclosure. As a temporary workaround, restrict the ability to create multiple ephemeral associations to prevent Sybil attacks from authenticated peers.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-5209

Produtos afetados

Ibm Aix

Ntp

Referências · 12

• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5209 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-5209 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95841 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5209 · Aviso do Fabricante
• https://aix.software.ibm.com/aix/efixes/security/ntp_advisory10.asc · Nota
• https://support.f5.com/csp/article/K44942017?utm_source=f5support&utm_medium=RSS · Nota
• https://cve.org/CVERecord?id=CVE-2014-5209 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-5209 · Nota de Segurança
• https://support.f5.com/csp/article/K44942017?utm_source=f5support&amp%3Butm_medium=RSS · Nota
• https://support.f5.com/csp/article/K44942017 · Nota
• https://ubuntu.com/security/CVE-2014-5209 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-5209 · Aviso do Fabricante