USN-2449-1

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/notices/USN-2449-1

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-2449-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/USN-2449-1

Related

Published

2014-12-22T13:12:53.073498Z

Modified

2014-12-22T13:12:53.073498Z

Summary

ntp vulnerabilities

Details

Neel Mehta discovered that NTP generated weak authentication keys. A remote attacker could possibly use this issue to brute force the authentication key and send requests if permitted by IP restrictions. (CVE-2014-9293)

Stephen Roettger discovered that NTP generated weak MD5 keys. A remote attacker could possibly use this issue to brute force the MD5 key and spoof a client or server. (CVE-2014-9294)

Stephen Roettger discovered that NTP contained buffer overflows in the cryptorecv(), ctlputdata() and configure() functions. In non-default configurations, a remote attacker could use these issues to cause NTP to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. In addition, attackers would be isolated by the NTP AppArmor profile. (CVE-2014-9295)

Stephen Roettger discovered that NTP incorrectly continued processing when handling certain errors. (CVE-2014-9296)

References

Affected packages

Ubuntu:14.04:LTS / ntp

Package

Name: ntp
Purl: pkg:deb/ubuntu/ntp@1:4.2.6.p5+dfsg-3ubuntu2.14.04.1?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:4.2.6.p5+dfsg-3ubuntu2.14.04.1

Affected versions

1:4.*

1:4.2.6.p5+dfsg-3ubuntu2

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "1:4.2.6.p5+dfsg-3ubuntu2.14.04.1",
            "binary_name": "ntp"
        },
        {
            "binary_version": "1:4.2.6.p5+dfsg-3ubuntu2.14.04.1",
            "binary_name": "ntp-doc"
        },
        {
            "binary_version": "1:4.2.6.p5+dfsg-3ubuntu2.14.04.1",
            "binary_name": "ntpdate"
        }
    ]
}