CVE-2014-9293 Weak cryptography in n/a

High 7.5 Published 20 Dec 2014 Updated 6 Aug 2024

Remote attackers can defeat NTP cryptographic protections via brute-force due to improper key generation when no auth key is configured.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-9293?

CVE-2014-9293 is a high-severity vulnerability in Ntp Ntp, published on 20 Dec 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

Which versions are affected by CVE-2014-9293?

It affects 1 product.

Products include Ntp Ntp.

How do I fix CVE-2014-9293?

Upgrade to a fixed version.

Is CVE-2014-9293 being exploited?

There is no known exploitation of CVE-2014-9293 in the wild and no public exploit code.

All Ntp Ntp vulnerabilities

Sources

Also known as DEBIAN-CVE-2014-9293, GHSA-39gg-qjj7-qm8m, UBUNTU-CVE-2014-9293.