PT-2018-4260 · Ntt+1 · Ntp+1

Published 2018-08-14 · Updated 2020-01-24 · CVE-2014-5209

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NTP version 4.2.7p25

Description The issue allows a malicious user to obtain sensitive information through private (mode 6/7) messages via a GET RESTRICT control message. Additionally, a remote authenticated attacker could bypass security restrictions by creating multiple ephemeral associations to win the clock selection of ntpd, potentially modifying a victim's clock.

Recommendations For NTP version 4.2.7p25, consider restricting access to the GET RESTRICT control message to prevent information disclosure. As a temporary workaround, restrict the ability to create multiple ephemeral associations to prevent Sybil attacks from authenticated peers.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-5209

Affected Products

Ibm Aix

Ntp

References · 12

• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5209 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-5209 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5209 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-5209 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-5209 · Security Note
• https://ubuntu.com/security/CVE-2014-5209 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-5209 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95841 · Note
• https://aix.software.ibm.com/aix/efixes/security/ntp_advisory10.asc · Note
• https://support.f5.com/csp/article/K44942017?utm_source=f5support&utm_medium=RSS · Note
• https://support.f5.com/csp/article/K44942017?utm_source=f5support&amp%3Butm_medium=RSS · Note
• https://support.f5.com/csp/article/K44942017 · Note