PT-2023-10106 · Unknown · Drybjed Ansible-Ntp

Published 2023-01-02 · Updated 2024-05-17 · CVE-2014-125036

Positive Technologies (AI Summary)

CVSS v2.0

1.4

Low

Base vector

AV:A/AC:H/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions drybjed ansible-ntp (affected versions not specified)

Description A problematic vulnerability has been found in drybjed ansible-ntp, affecting some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control of network message volume. The attack can only be done within the local network. The complexity of an attack is rather high, and the exploitation is known to be difficult.

Recommendations To fix this issue, it is recommended to apply a patch, specifically the one identified as ed4ca2cf012677973c220cdba36b5c60bfa0260b. As a temporary workaround, consider restricting access to the meta/main.yml file until a patch is applied.

Fix

Weakness Enumeration

CWE-406

Related Identifiers

CVE-2014-125036

Affected Products

Drybjed Ansible-Ntp

References · 6

• https://github.com/drybjed/ansible-ntp/commit/ed4ca2cf012677973c220cdba36b5c60bfa0260b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-125036 · Security Note
• https://vuldb.com/?id.217190 · Note
• https://t.me/cvenotify/41119 · Telegram Post
• https://vuldb.com/?ctiid.217190 · Note
• https://t.me/cibsecurity/55744 · Telegram Post