CVE-2014-9293

CVE Details

Release Date:	2014-12-19
Impact:	Moderate	What is this?

Description

It was found that ntpd automatically generated weak keys for its internal use if no ntpdc request authentication key was specified in the ntp.conf configuration file. A remote attacker able to match the configured IP restrictions could guess the generated key, and possibly use it to send ntpdc query or configuration requests.

See more information about CVE-2014-9293 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	4.0
Vector String:	AV:N/AC:H/Au:N/C:P/I:P/A:N
Version:	2.0
Attack Vector:	Network
Attack Complexity:	High
Authentication:	None
Confidentiality Impact:	Partial
Integrity Impact:	Partial
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle VM version 2.2 (ntp)	OVMSA-2015-0002	2015-01-06
Oracle Linux version 5 (ntp)	ELSA-2014-2025	2014-12-20
Oracle Linux version 6 (ntp)	ELSA-2014-2024	2014-12-20
Oracle Linux version 7 (ntp)	ELSA-2014-2024	2014-12-20
Oracle VM version 3.2 (ntp)	OVMSA-2015-0001	2015-01-06
Oracle VM version 3.3 (ntp)	OVMSA-2014-0085	2014-12-23