{"id":"CVE-2014-9295","aliases":["DEBIAN-CVE-2014-9295","DLA-116-1","DSA-3108-1","EUVD-2014-9120","GHSA-67hp-c7g3-34pp","MGASA-2014-0541","RHSA-2014:2024","RHSA-2014:2025","RHSA-2015:0104","SUSE-SU-2015:0259-1","SUSE-SU-2015:0259-2","SUSE-SU-2015:0259-3","SUSE-SU-2015:1173-1","UBUNTU-CVE-2014-9295","USN-2449-1","openSUSE-SU-2024:10181-1"],"status":"published","title":"Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to...","description":"Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.79069,"percentile":0.996,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119"],"published":"2012-11-22T17:45:21Z","modified":"2026-08-27T12:47:33Z","exploits":[{"source":"pocgithub","id":"MacMiniVault/NTPUpdateSnowLeopard","title":"MacMiniVault/NTPUpdateSnowLeopard","date":"2014-12-26","url":"https://github.com/MacMiniVault/NTPUpdateSnowLeopard"}],"fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.6.p5+dfsg-3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ntp","fixed_in":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3.2"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p2+dfsg-1+deb6u1"}]}],"versions":["1:4.2.6.p2+dfsg-1"],"bundled":4},{"source":"osv","ecosystem":"Debian:7","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-2+deb7u1"}]}],"versions":["1:4.2.6.p5+dfsg-2"],"bundled":4},{"source":"osv","ecosystem":"Mageia:4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-15.2.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-19.el7_0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2p1-18.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2p1-18.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2p1-18.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2p1-18.el5_11"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::computenode","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:6.5::server","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-2.el6_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.1"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.1"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-1.1"}]}],"bundled":60}],"products":[{"vendor":"ntp","product":"ntp"}],"references":[{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141222-ntpd","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/71761","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142590659431171\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04790232","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://bugs.ntp.org/show_bug.cgi?id=2667","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10103","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0541.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.kb.cert.org/vuls/id/852879","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory","web","report"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142853370924302\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-2025.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1176037","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://secunia.com/advisories/62209","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0104.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=144182594518755\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://bk1.ntp.org/ntp-dev/?PAGE=patch\u0026REV=548acc4dN1TbM1tRJrbPcA4yc1aTdA","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://bugs.ntp.org/show_bug.cgi?id=2668","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://bk1.ntp.org/ntp-dev/?PAGE=patch\u0026REV=548acdf3tUSFizXcv_X4b77Jt_Y-cg","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://bk1.ntp.org/ntp-dev/?PAGE=patch\u0026REV=548acf55dxKfhb6MuYQwzu8eDlS97g","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142469153211996\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04916783","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417665.htm","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:003","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://bugs.ntp.org/show_bug.cgi?id=2669","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisories/1047-security-advisory-8","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9295","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-67hp-c7g3-34pp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9295","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0541.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14858","tags":["report"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#Resolved_Vulnerabilities","tags":["web"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-14-353-01","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1176032","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1176035","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1176040","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:2024","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_2024.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9293","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9293","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9293","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#Weak_default_key_in_config_auth","tags":["article"]},{"url":"https://access.redhat.com/articles/1305723","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9294","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9294","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#non_cryptographic_random_number","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9295","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9295","tags":["advisory","report"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#Buffer_overflow_in_crypto_recv","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9296","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#receive_missing_return_on_error","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2014:2025","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_2025.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0104","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0104.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150259-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/838458","tags":["report"]},{"url":"https://bugzilla.suse.com/857195","tags":["report"]},{"url":"https://bugzilla.suse.com/883859","tags":["report"]},{"url":"https://bugzilla.suse.com/887957","tags":["report"]},{"url":"https://bugzilla.suse.com/910764","tags":["report"]},{"url":"https://bugzilla.suse.com/911792","tags":["report"]},{"url":"https://bugzilla.suse.com/924202","tags":["report"]},{"url":"https://bugzilla.suse.com/928321","tags":["report"]},{"url":"https://bugzilla.suse.com/935409","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3405","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150259-2/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/758253","tags":["report"]},{"url":"https://bugzilla.suse.com/771480","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150259-3/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/611513","tags":["report"]},{"url":"https://bugzilla.suse.com/645356","tags":["report"]},{"url":"https://bugzilla.suse.com/656345","tags":["report"]},{"url":"https://bugzilla.suse.com/680301","tags":["report"]},{"url":"https://bugzilla.suse.com/692969","tags":["report"]},{"url":"https://bugzilla.suse.com/730374","tags":["report"]},{"url":"https://bugzilla.suse.com/734467","tags":["report"]},{"url":"https://bugzilla.suse.com/817893","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151173-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-9295","tags":["report"]},{"url":"http://cwe.mitre.org/data/definitions/121.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2449-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-9293","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9294","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9296","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9311","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-9295","description":"Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.","status":"published","published":"2014-12-20T02:00:00Z","modified":"2024-08-06T13:40:24.985Z","updated_at":"2026-11-02T14:33:42.882687Z"}],"euvd":[{"id":"EUVD-2014-9120","description":"Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.","status":"published","published":"2014-12-20T02:00:00Z","modified":"2024-08-06T13:40:24Z","updated_at":"2026-11-03T01:56:49.729528Z"}],"ghsa":[{"id":"GHSA-67hp-c7g3-34pp","title":"Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to...","description":"Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.","status":"published","published":"2022-05-13T01:05:12Z","modified":"2023-02-01T05:02:50Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:49:58.498747Z"}],"nvd":[{"id":"CVE-2014-9295","description":"Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.","status":"published","published":"2014-12-20T02:59:02.693Z","modified":"2026-06-17T00:18:03.94Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"CVE-2014-9295","description":"Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.","status":"published","published":"2014-12-20T02:59:02Z","modified":"2026-04-16T06:21:04.806671237Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9295","description":"Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.","status":"published","published":"2014-12-20T02:59:02.693Z","modified":"2026-08-27T12:47:33.638996383Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-116-1","title":"ntp - security update","status":"published","published":"2014-12-20T00:00:00Z","modified":"2026-03-09T01:00:52.804451Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3108-1","title":"ntp - security update","status":"published","published":"2014-12-20T00:00:00Z","modified":"2026-03-09T01:22:00.970251Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0541","title":"Updated ntp packages fix security vulnerabilities","description":"Updated ntp packages fix security vulnerabilities:\n\nIf no authentication key is defined in the ntp.conf file, a\ncryptographically-weak default key is generated (CVE-2014-9293).\n\nntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator\nwith a weak seed to generate symmetric keys (CVE-2014-9294).\n\nA remote unauthenticated attacker may craft special packets that trigger\nbuffer overflows in the ntpd functions crypto_recv() (when using autokey\nauthentication), ctl_putdata(), and configure(). The resulting buffer\noverflows may be exploited to allow arbitrary malicious code to be executed\nwith the privilege of the ntpd process (CVE-2014-9295).\n\nA section of code in ntpd handling a rare error is missing a return\nstatement, therefore processing did not stop when the error was encountered.\nThis situation may be exploitable by an attacker (CVE-2014-9296).\n\nThe ntp package has been patched to fix these issues.\n","status":"published","published":"2014-12-20T13:51:12Z","modified":"2026-04-16T06:23:06.967439635Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10181-1","title":"ntp-4.2.8p9-1.1 on GA media","description":"These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:26.696395Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:2024","title":"Red Hat Security Advisory: ntp security update","status":"published","published":"2024-09-15T22:16:12Z","modified":"2026-06-27T10:01:23Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:2025","title":"Red Hat Security Advisory: ntp security update","status":"published","published":"2024-09-15T22:16:17Z","modified":"2026-06-27T10:01:23Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2015:0104","title":"Red Hat Security Advisory: ntp security update","status":"published","published":"2024-09-15T22:16:05Z","modified":"2026-06-27T10:01:41Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:0259-1","title":"Recommended update for ntp","description":"\nThis update for ntp provides the following fixes:\n\n    * Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.\n      (bnc#887957)\n    * Fix orphan mode. (bnc#883859)\n\n","status":"published","published":"2014-11-18T12:31:05Z","modified":"2025-05-02T04:03:59.725525Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0259-2","title":"Recommended update for ntp","description":"\nThis collective update for the Network Time Protocol daemon (ntp) provides \nfixes for the following reports:\n\n    * 758253: ntp fails if a host has more than 1024 IP addresses\n    * 771480: sntp not able to sync against Windows ntp server.\n\n","status":"published","published":"2012-11-22T17:45:21Z","modified":"2026-02-04T02:42:22.119171Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0259-3","title":"Security update for ntp","description":"\nThe NTP time service could have been used for remote denial of service \namplification attacks.\n\nThis issue can be fixed by the administrator as we described in our \nsecurity advisory SUSE-SA:2014:001\n\nhttp://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html\n\u003chttp://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html\u003e\n\nand on\n\nhttp://support.novell.com/security/cve/CVE-2013-5211.html\n\u003chttp://support.novell.com/security/cve/CVE-2013-5211.html\u003e\n\nthis update now also replaces the default ntp.conf template to fix this \nproblem.\n\nPlease note that if you have touched or modified ntp.conf yourself, it will \nnot be automatically fixed, you need to merge the changes manually as \ndescribed.\n\nAdditionally the following bug has been fixed:\n\n    * ntp start script does not update /var/lib/ntp/etc/localtime file if\n      /etc/localtime is symlink (bnc#838458)\n\nSecurity Issues:\n\n    * CVE-2013-5211\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211\u003e\n\n","status":"published","published":"2014-07-21T14:05:24Z","modified":"2026-02-04T03:48:05.752255Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1173-1","title":"Recommended update for ntp","description":"\nThis update for ntp provides the following fixes:\n\n    * Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.\n      (bnc#887957)\n    * Fix orphan mode. (bnc#883859)\n\n","status":"published","published":"2014-11-18T12:31:05Z","modified":"2025-05-02T04:03:59.848835Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2014-9295","description":"Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.","status":"published","published":"2014-12-19T00:00:00Z","modified":"2026-02-04T04:14:05.03083Z","updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"USN-2449-1","title":"ntp vulnerabilities","description":"Neel Mehta discovered that NTP generated weak authentication keys. A remote\nattacker could possibly use this issue to brute force the authentication\nkey and send requests if permitted by IP restrictions. (CVE-2014-9293)\n\nStephen Roettger discovered that NTP generated weak MD5 keys. A remote\nattacker could possibly use this issue to brute force the MD5 key and spoof\na client or server. (CVE-2014-9294)\n\nStephen Roettger discovered that NTP contained buffer overflows in the\ncrypto_recv(), ctl_putdata() and configure() functions. In non-default\nconfigurations, a remote attacker could use these issues to cause NTP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. The default compiler options for affected releases should reduce the\nvulnerability to a denial of service. In addition, attackers would be\nisolated by the NTP AppArmor profile. (CVE-2014-9295)\n\nStephen Roettger discovered that NTP incorrectly continued processing when\nhandling certain errors. (CVE-2014-9296)\n","status":"published","published":"2014-12-22T13:12:53Z","modified":"2026-02-10T04:40:51Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}