7.5
HIGH
CVE-2014-9295
NTP Stack-Based Buffer Overflows
Description

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.

INFO

Published Date :

Dec. 20, 2014, 2:59 a.m.

Last Modified :

Nov. 17, 2021, 10:15 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

6.4

Exploitability Score :

10.0
Public PoC/Exploit Available at Github

CVE-2014-9295 has a 5 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2014-9295 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Ntp ntp
: Total Affected Vendor : 1 | Products : 1
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2014-9295.

URL Resource
http://advisories.mageia.org/MGASA-2014-0541.html
http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acc4dN1TbM1tRJrbPcA4yc1aTdA Exploit
http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acdf3tUSFizXcv_X4b77Jt_Y-cg Exploit
http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acf55dxKfhb6MuYQwzu8eDlS97g Exploit
http://bugs.ntp.org/show_bug.cgi?id=2667
http://bugs.ntp.org/show_bug.cgi?id=2668
http://bugs.ntp.org/show_bug.cgi?id=2669
http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00020.html
http://marc.info/?l=bugtraq&m=142469153211996&w=2
http://marc.info/?l=bugtraq&m=142590659431171&w=2
http://marc.info/?l=bugtraq&m=142853370924302&w=2
http://marc.info/?l=bugtraq&m=144182594518755&w=2
http://rhn.redhat.com/errata/RHSA-2014-2025.html
http://rhn.redhat.com/errata/RHSA-2015-0104.html
http://secunia.com/advisories/62209
http://support.ntp.org/bin/view/Main/SecurityNotice Vendor Advisory
http://www.kb.cert.org/vuls/id/852879 Third Party Advisory US Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2015:003
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
http://www.securityfocus.com/bid/71761
http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417665.htm
https://bugzilla.redhat.com/show_bug.cgi?id=1176037
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04790232
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04916783
https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes
https://kc.mcafee.com/corporate/index?page=content&id=SB10103
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141222-ntpd
https://www.arista.com/en/support/advisories-notices/security-advisories/1047-security-advisory-8

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
oneoy/cve-

None

C Perl 6 Perl ASP HTML Rich Text Format Visual Basic TeX Assembly Shell

Updated: 1 month, 1 week ago
1 stars 1 fork 1 watcher
Born at : June 13, 2019, 1:51 p.m. This repo has been linked 308 different CVEs too.
Profile Photo
mudongliang/LinuxFlaw

The vm images in this repo are lost, we recommend our new project: https://github.com/hust-open-atom-club/S2VulnHub

linux vulnerability reproduction cve edb

Shell C Perl PHP TeX Python Assembly Makefile HTML XSLT

Updated: 2 weeks, 3 days ago
327 stars 70 fork 70 watcher
Born at : July 30, 2015, 10:36 a.m. This repo has been linked 309 different CVEs too.
Profile Photo
opragel/osx-10.7-ntp

Contains NTP update for Apple OS X 10.7 Lion.

CSS Perl Shell

Updated: 1 year, 7 months ago
0 stars 0 fork 0 watcher
Born at : Dec. 28, 2014, 3:35 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
MacMiniVault/NTPUpdateSnowLeopard

Updates OS X 10.6.8 NTP to include patch for CVE-2014-9295

Perl

Updated: 4 years, 3 months ago
5 stars 1 fork 1 watcher
Born at : Dec. 26, 2014, 3:30 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
sous-chefs/ntp

Development repository for the ntp cookbook

chef hacktoberfest chef-cookbook chef-resource ntp managed-by-terraform

Ruby HTML Shell

Updated: 2 months ago
68 stars 144 fork 144 watcher
Born at : March 14, 2012, 6:17 p.m. This repo has been linked 3 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2014-9295 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2014-9295 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 17, 2021

    Action Type Old Value New Value
    Added Reference https://www.arista.com/en/support/advisories-notices/security-advisories/1047-security-advisory-8 [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 10, 2021

    Action Type Old Value New Value
    Removed Reference https://www.arista.com/en/support/advisories-notices/security-advisories/1047-security-advisory-8 [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 05, 2021

    Action Type Old Value New Value
    Added Reference https://www.arista.com/en/support/advisories-notices/security-advisories/1047-security-advisory-8 [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 30, 2018

    Action Type Old Value New Value
    Added Reference https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 10, 2017

    Action Type Old Value New Value
    Added Reference http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00020.html [No Types Assigned]
  • CVE Modified by [email protected]

    Jan. 03, 2017

    Action Type Old Value New Value
    Added Reference https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141222-ntpd [No Types Assigned]
    Added Reference https://kc.mcafee.com/corporate/index?page=content&id=SB10103 [No Types Assigned]
    Added Reference http://secunia.com/advisories/62209 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 22, 2016

    Action Type Old Value New Value
    Added Reference https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04790232 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 07, 2016

    Action Type Old Value New Value
    Added Reference https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04916783 [No Types Assigned]
    Added Reference http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417665.htm [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 28, 2016

    Action Type Old Value New Value
    Added Reference http://www.securityfocus.com/bid/71761 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 26, 2016

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
  • CVE Modified by [email protected]

    Aug. 23, 2016

    Action Type Old Value New Value
    Added Reference http://marc.info/?l=bugtraq&m=144182594518755&w=2
    Added Reference http://marc.info/?l=bugtraq&m=142853370924302&w=2
  • CVE Modified by [email protected]

    Mar. 26, 2015

    Action Type Old Value New Value
    Added Reference http://www.mandriva.com/security/advisories?name=MDVSA-2015:003
    Added Reference http://advisories.mageia.org/MGASA-2014-0541.html
  • CVE Modified by [email protected]

    Mar. 12, 2015

    Action Type Old Value New Value
    Added Reference http://marc.info/?l=bugtraq&m=142590659431171&w=2
  • CVE Modified by [email protected]

    Feb. 26, 2015

    Action Type Old Value New Value
    Added Reference http://marc.info/?l=bugtraq&m=142469153211996&w=2
  • CVE Modified by [email protected]

    Feb. 24, 2015

    Action Type Old Value New Value
    Added Reference http://rhn.redhat.com/errata/RHSA-2014-2025.html
    Added Reference http://rhn.redhat.com/errata/RHSA-2015-0104.html
  • Modified Analysis by [email protected]

    Dec. 22, 2014

    Action Type Old Value New Value
    Added CPE Configuration Configuration 1 OR *cpe:2.3:a:ntp:ntp:4.2.7:*:*:*:*:*:*:* (and previous)
    Added CVSS V2 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
    Changed Reference Type http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acdf3tUSFizXcv_X4b77Jt_Y-cg No Types Assigned http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acdf3tUSFizXcv_X4b77Jt_Y-cg Exploit
    Changed Reference Type http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acc4dN1TbM1tRJrbPcA4yc1aTdA No Types Assigned http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acc4dN1TbM1tRJrbPcA4yc1aTdA Exploit
    Changed Reference Type http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acf55dxKfhb6MuYQwzu8eDlS97g No Types Assigned http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acf55dxKfhb6MuYQwzu8eDlS97g Exploit
    Changed Reference Type http://support.ntp.org/bin/view/Main/SecurityNotice No Types Assigned http://support.ntp.org/bin/view/Main/SecurityNotice Advisory
    Changed Reference Type http://www.kb.cert.org/vuls/id/852879 US Govt Resource http://www.kb.cert.org/vuls/id/852879 Advisory, US Govt Resource
    Added CWE CWE-119
  • Initial Analysis by [email protected]

    Dec. 22, 2014

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

96.45 }} -0.18%

score

0.99620

percentile

CVSS2 - Vulnerability Scoring System
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
: