CVE-2014-9750

Опубликовано: 06 окт. 2015

Источник: nvd

CVSS2: 5.8

EPSS Средний

Описание

ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.

Ссылки

http://bugs.ntp.org/show_bug.cgi?id=2671
Issue Tracking
Patch
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1459.html
Third Party Advisory
http://support.ntp.org/bin/view/Main/SecurityNotice#December_2014_NTP_Security_Vulne
Release Notes
Vendor Advisory
http://www.debian.org/security/2015/dsa-3388
Third Party Advisory
http://www.kb.cert.org/vuls/id/852879
Third Party Advisory
US Government Resource
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
Third Party Advisory
http://www.securityfocus.com/bid/72583
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1184573
Issue Tracking
Patch
Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us
Third Party Advisory
http://bugs.ntp.org/show_bug.cgi?id=2671
Issue Tracking
Patch
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1459.html
Third Party Advisory
http://support.ntp.org/bin/view/Main/SecurityNotice#December_2014_NTP_Security_Vulne
Release Notes
Vendor Advisory
http://www.debian.org/security/2015/dsa-3388
Third Party Advisory
http://www.kb.cert.org/vuls/id/852879
Third Party Advisory
US Government Resource
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
Third Party Advisory
http://www.securityfocus.com/bid/72583
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1184573
Issue Tracking
Patch
Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*

Версия от 4.2.0 (включая) до 4.2.8 (исключая)

cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.10156

Средний

5.8 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2014-9750

ubuntu

около 10 лет назад

CVE-2014-9750

redhat

почти 11 лет назад

CVE-2014-9750

debian

около 10 лет назад

ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentic ...

GHSA-2cf6-qqmm-m55v

github

больше 3 лет назад

ELSA-2015-2231

oracle-oval

почти 10 лет назад

ELSA-2015-2231: ntp security, bug fix, and enhancement update (MODERATE)

EPSS

Процентиль: 93%

0.10156

Средний

5.8 Medium

CVSS2

Дефекты

CWE-20