{"id":"CVE-2014-5209","aliases":["DEBIAN-CVE-2014-5209","EUVD-2014-5107","GHSA-m44h-f944-f3x3","UBUNTU-CVE-2014-5209"],"status":"published","title":"An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a...","description":"An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02502,"percentile":0.84831,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2020-01-08T00:29:42Z","modified":"2026-08-27T13:02:51Z","fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.8p3+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3","1:4.2.6.p5+dfsg-3ubuntu2.14.04.5","1:4.2.6.p5+dfsg-3ubuntu2.14.04.6","1:4.2.6.p5+dfsg-3ubuntu2.14.04.7","1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","1:4.2.6.p5+dfsg-3ubuntu2.14.04.10","1:4.2.6.p5+dfsg-3ubuntu2.14.04.11","1:4.2.6.p5+dfsg-3ubuntu2.14.04.12","1:4.2.6.p5+dfsg-3ubuntu2.14.04.13","1:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1"]}],"products":[{"vendor":"f5","product":"big-ip_access_policy_manager"},{"vendor":"f5","product":"big-ip_advanced_firewall_manager"},{"vendor":"f5","product":"big-ip_analytics"},{"vendor":"f5","product":"big-ip_application_acceleration_manager"},{"vendor":"f5","product":"big-ip_application_security_manager"},{"vendor":"f5","product":"big-ip_domain_name_system"},{"vendor":"f5","product":"big-ip_edge_gateway"},{"vendor":"f5","product":"big-ip_global_traffic_manager"},{"vendor":"f5","product":"big-ip_link_controller"},{"vendor":"f5","product":"big-ip_local_traffic_manager"},{"vendor":"f5","product":"big-ip_policy_enforcement_manager"},{"vendor":"f5","product":"big-ip_protocol_security_module"},{"vendor":"f5","product":"big-ip_wan_optimization_manager"},{"vendor":"f5","product":"big-ip_webaccelerator"},{"vendor":"f5","product":"big-iq_adc"},{"vendor":"f5","product":"big-iq_centralized_management"},{"vendor":"f5","product":"big-iq_cloud"},{"vendor":"f5","product":"big-iq_cloud_and_orchestration"},{"vendor":"f5","product":"big-iq_device"},{"vendor":"f5","product":"big-iq_security"},{"vendor":"f5","product":"enterprise_manager"},{"vendor":"f5","product":"iworkflow"},{"vendor":"f5","product":"mobilesafe"},{"vendor":"f5","product":"websafe"},{"vendor":"ntp","product":"ntp"},{"vendor":"ntp project","product":"ntp"}],"references":[{"url":"https://support.f5.com/csp/article/K44942017","tags":["x_refsource_CONFIRM","x_refsource_MISC","x_transferred","web","report"]},{"url":"https://support.f5.com/csp/article/K44942017?utm_source=f5support\u0026amp%3Butm_medium=RSS","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/95841","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5209"},{"url":"https://support.f5.com/csp/article/K44942017?utm_source=f5support\u0026amp;utm_medium=RSS","tags":["report"]},{"url":"https://github.com/advisories/GHSA-m44h-f944-f3x3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-5209","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-5209","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5209","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-5209","description":"An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.","status":"published","published":"2020-01-08T00:29:42Z","modified":"2024-08-06T11:41:47.478Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2014-5107","description":"An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.","status":"published","published":"2020-01-08T00:29:42Z","modified":"2024-08-06T11:41:47Z","updated_at":"2026-11-03T01:57:03.789124Z"}],"ghsa":[{"id":"GHSA-m44h-f944-f3x3","title":"An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a...","description":"An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.","status":"published","published":"2022-05-17T19:57:13Z","modified":"2023-01-28T05:05:17Z","updated_at":"2026-11-02T14:44:19.546147Z"}],"nvd":[{"id":"CVE-2014-5209","description":"An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.","status":"published","published":"2020-01-08T01:15:09.547Z","modified":"2026-06-17T00:11:13.26Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:59.461996Z"}],"osv":[{"id":"CVE-2014-5209","description":"An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.","status":"published","published":"2020-01-08T01:15:09Z","modified":"2026-04-10T03:43:56.228213Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-5209","description":"An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.","status":"published","published":"2020-01-08T01:15:09.547Z","modified":"2026-08-27T13:02:51.302971238Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"UBUNTU-CVE-2014-5209","description":"An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.","status":"published","published":"2020-01-08T01:15:00Z","modified":"2025-09-08T16:43:12Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:09.010095Z"}]}}