PT-2014-1838 · Ntp+9 · Ntp+10
Published
2014-12-19
·
Updated
2024-06-15
·
CVE-2014-9293
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
NTP versions prior to 4.2.7p11
NTP versions 4.2.6p5 and earlier
Description
The issue is related to the
config auth function in NTP, which generates a cryptographically-weak default key when no authentication key is defined. This makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. The vulnerability can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information.Recommendations
For NTP versions prior to 4.2.7p11, update to version 4.2.7p11 or later to resolve the issue.
For NTP versions 4.2.6p5 and earlier, consider disabling the
config auth function until a patch is available.
As a temporary workaround, restrict access to the NTP service to minimize the risk of exploitation.Exploit
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Check Point Gaia
Cisco Ios Xr
Cisco Nexus
Hp-Ux
Ibm Aix
Ntp
Red Hat
Suse
Ubuntu