CVE-2014-9750
Fixed in a distro release EPSS 6%
ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.
Products: ntp, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_workstation, debian_linux, oracle linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | ntp | 1:4.2.6.p5+dfsg-5 |
| Debian 6.0 | ntp | 1:4.2.6.p2+dfsg-1+deb6u2 |
| Debian 7 | ntp | 1:4.2.6.p5+dfsg-2+deb7u2 |
| Debian 7 | ntp | 1:4.2.6.p5+dfsg-2+deb7u3 |
| Red Hat Enterprise Linux 6 | ntp | 0:4.2.6p5-5.el6 |
| Red Hat Enterprise Linux 6 | ntp-debuginfo | 0:4.2.6p5-5.el6 |
| Red Hat Enterprise Linux 6 | ntp-doc | 0:4.2.6p5-5.el6 |
| Red Hat Enterprise Linux 6 | ntp-perl | 0:4.2.6p5-5.el6 |
| Red Hat Enterprise Linux 6 | ntpdate | 0:4.2.6p5-5.el6 |
| Red Hat Enterprise Linux 7 | ntp | 0:4.2.6p5-22.el7 |
| Red Hat Enterprise Linux 7 | ntp-debuginfo | 0:4.2.6p5-22.el7 |
| Red Hat Enterprise Linux 7 | ntp-doc | 0:4.2.6p5-22.el7 |
| Red Hat Enterprise Linux 7 | ntp-perl | 0:4.2.6p5-22.el7 |
| Red Hat Enterprise Linux 7 | ntpdate | 0:4.2.6p5-22.el7 |
| Red Hat Enterprise Linux 7 | sntp | 0:4.2.6p5-22.el7 |