Summary
[4.2.6p5-2]
- don't generate weak control key for resolver (CVE-2014-9293)
- don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
- fix buffer overflows via specially-crafted packets (CVE-2014-9295)
- don't mobilize passive association when authentication fails (CVE-2014-9296)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ntp | 0:4.2.6p5-19.el7_0 |
| Oracle Linux · 7 | ntp-doc | 0:4.2.6p5-19.el7_0 |
| Oracle Linux · 7 | ntp-perl | 0:4.2.6p5-19.el7_0 |
| Oracle Linux · 7 | ntpdate | 0:4.2.6p5-19.el7_0 |
| Oracle Linux · 7 | sntp | 0:4.2.6p5-19.el7_0 |
Vulnerabilities 4
-
Unscored —CVE-2014-9293 EPSS 13%
The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key…
-
Unscored —CVE-2014-9294 EPSS 13%
util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attacker…
-
Unscored —
Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via …
-
Unscored —CVE-2014-9296 EPSS 16%
The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authenti…