CVE-2014-9294

CVE Details

Release Date:	2014-12-19
Impact:	Moderate	What is this?

Description

It was found that ntp-keygen used a weak method for generating MD5 keys. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server. Note: it is recommended to regenerate any MD5 keys that had explicitly been generated with ntp-keygen; the default installation does not contain such keys).

See more information about CVE-2014-9294 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	4.0
Vector String:	AV:N/AC:H/Au:N/C:P/I:P/A:N
Version:	2.0
Attack Vector:	Network
Attack Complexity:	High
Authentication:	None
Confidentiality Impact:	Partial
Integrity Impact:	Partial
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle VM version 2.2 (ntp)	OVMSA-2015-0002	2015-01-06
Oracle Linux version 5 (ntp)	ELSA-2014-2025	2014-12-20
Oracle Linux version 6 (ntp)	ELSA-2014-2024	2014-12-20
Oracle Linux version 7 (ntp)	ELSA-2014-2024	2014-12-20
Oracle VM version 3.2 (ntp)	OVMSA-2015-0001	2015-01-06
Oracle VM version 3.3 (ntp)	OVMSA-2014-0085	2014-12-23