CVE-2014-9294 — Improper Restriction of Operations within the Bounds of a Memory Buffer in NTP
CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-20 — Improper Input ValidationCWE-200 — Sensitive Information ExposureCWE-264CWE-310CWE-335 — Incorrect Usage of Seeds in Pseudo-Random Number GeneratorCWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator20 documents10 sources
Severity
7.5HIGHNVD
EPSS
33.3%
top 3.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 20
Latest updateMay 13
Description
util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
CVSS vector
AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4