CVE-2014-9751 — Improper Input Validation in Linux

CWE-20 — Improper Input Validation7 documents7 sources
Severity
6.8MEDIUMNVD
EPSS
4.8%
top 10.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
NTPDebian LinuxOracle Linux+3 more
Timeline
PublishedOct 6
Latest updateMay 13

Description

The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages6 packages

▶NVDntp/ntp4.2.0 — 4.2.8+1

Also affects: Debian Linux 7.0, 8.0, 9.0

Patches

Patch: bugs.ntp.org ↗Patch: bugs.ntp.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-ffj6-rf7h-c479: The read_network_packet function in ntp_io↗2022-05-13
▶
OSV
CVE-2014-9751: The read_network_packet function in ntp_io↗2015-10-06
▶
CVEList
CVE-2014-9751: The read_network_packet function in ntp_io↗2015-10-04
▶

📋Vendor Advisories

2
Red Hat
ntp: drop packets with source address ::1↗2015-02-04
▶
Debian
CVE-2014-9751: ntp - The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 o...↗2014
▶

💬Community

1
Bugzilla
CVE-2014-9298 CVE-2014-9751 ntp: drop packets with source address ::1↗2015-01-21
▶
CVE-2014-9751 — Improper Input Validation in Linux | cvebase