CVE-2014-9296 Security feature bypass in n/a
Remote attackers can bypass authentication checks in NTP to trigger unintended association changes via crafted packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-9296?
CVE-2014-9296 is a medium-severity vulnerability in Ntp Ntp, published on 20 Dec 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets.
Weakness: CWE-17
Which versions are affected by CVE-2014-9296?
It affects 1 product.
Products include Ntp Ntp.
How do I fix CVE-2014-9296?
Upgrade to a fixed version.
Is CVE-2014-9296 being exploited?
There is no known exploitation of CVE-2014-9296 in the wild and no public exploit code.
Other vulnerabilities in Ntp Ntp
Sources
Also known as DEBIAN-CVE-2014-9296, GHSA-9prp-4cr8-gqhf, UBUNTU-CVE-2014-9296.