medium
5.3
CWE
200
Advisory Published
Updated

CVE-2014-5209: Infoleak

First published: Wed Jan 08 2020(Updated: )

An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.

Credit: cret@cert.org

Affected SoftwareAffected VersionHow to fix
NTP ntp=4.2.7-p25
F5 Access Policy Manager>=10.2.1<=10.2.4
F5 Access Policy Manager>=11.4.0<=11.6.4
F5 Access Policy Manager>=12.0.0<=12.1.4
F5 Access Policy Manager>=13.0.0<=13.1.1
F5 Access Policy Manager>=14.0.0<=14.1.0
F5 Access Policy Manager=11.2.1
F5 Access Policy Manager=15.0.0
F5 BIG-IP Advanced Firewall Manager>=11.4.0<=11.6.4
F5 BIG-IP Advanced Firewall Manager>=12.0.0<=12.1.4
F5 BIG-IP Advanced Firewall Manager>=13.0.0<=13.1.1
F5 BIG-IP Advanced Firewall Manager>=14.0.0<=14.1.0
F5 BIG-IP Advanced Firewall Manager=15.0.0
F5 BIG-IP Analytics>=11.4.0<=11.6.4
F5 BIG-IP Analytics>=12.0.0<=12.1.4
F5 BIG-IP Analytics>=13.0.0<=13.1.1
F5 BIG-IP Analytics>=14.0.0<=14.1.0
F5 BIG-IP Analytics=11.2.1
F5 BIG-IP Analytics=15.0.0
f5 big-ip application acceleration manager>=11.4.0<=11.6.4
f5 big-ip application acceleration manager>=12.0.0<=12.1.4
f5 big-ip application acceleration manager>=13.0.0<=13.1.1
f5 big-ip application acceleration manager>=14.0.0<=14.1.0
f5 big-ip application acceleration manager=15.0.0
F5 Application Security Manager>=10.2.1<=10.2.4
F5 Application Security Manager>=11.4.0<=11.6.4
F5 Application Security Manager>=12.0.0<=12.1.4
F5 Application Security Manager>=13.0.0<=13.1.1
F5 Application Security Manager>=14.0.0<=14.1.0
F5 Application Security Manager=11.2.1
F5 Application Security Manager=15.0.0
f5 big-ip domain name system>=12.0.0<=12.1.4
f5 big-ip domain name system>=13.0.0<=13.1.1
f5 big-ip domain name system>=14.0.0<=14.1.0
f5 big-ip domain name system=15.0.0
F5 BIG-IP Edge Gateway>=10.2.1<=10.2.4
F5 BIG-IP Edge Gateway=11.2.1
F5 BIG-IP Global Traffic Manager>=10.2.1<=10.2.4
F5 BIG-IP Global Traffic Manager>=11.4.0<=11.6.4
F5 BIG-IP Global Traffic Manager=11.2.1
F5 BIG-IP>=10.2.1<=10.2.4
F5 BIG-IP>=11.4.0<=11.6.4
F5 BIG-IP>=12.0.0<=12.1.4
F5 BIG-IP>=13.0.0<=13.1.1
F5 BIG-IP>=14.0.0<=14.1.0
F5 BIG-IP=11.2.1
F5 BIG-IP=15.0.0
F5 BIG-IP Local Traffic Manager>=10.2.1<=10.2.4
F5 BIG-IP Local Traffic Manager>=11.4.0<=11.6.4
F5 BIG-IP Local Traffic Manager>=12.0.0<=12.1.4
F5 BIG-IP Local Traffic Manager>=13.0.0<=13.1.1
F5 BIG-IP Local Traffic Manager>=14.0.0<=14.1.0
F5 BIG-IP Local Traffic Manager=11.2.1
F5 BIG-IP Local Traffic Manager=15.0.0
F5 BIG-IP Policy Enforcement Manager>=11.4.0<=11.6.4
F5 BIG-IP Policy Enforcement Manager>=12.0.0<=12.1.4
F5 BIG-IP Policy Enforcement Manager>=13.0.0<=13.1.1
F5 BIG-IP Policy Enforcement Manager>=14.0.0<=14.1.0
F5 BIG-IP Policy Enforcement Manager=15.0.0
F5 BIG-IP Protocol Security Manager>=10.2.1<=10.2.4
F5 BIG-IP Protocol Security Manager>=11.4.0<=11.4.1
F5 BIG-IP WAN Optimization Manager>=10.2.1<=10.2.4
F5 BIG-IP WAN Optimization Manager=11.2.1
F5 BIG-IP WebAccelerator>=10.2.1<=10.2.4
F5 BIG-IP WebAccelerator=11.2.1
F5 BIG-IQ Application Delivery Controller=4.5.0
F5 BIG-IP and BIG-IQ Centralized Management>=5.0.0<=5.4.0
F5 BIG-IP and BIG-IQ Centralized Management>=6.0.0<=6.1.0
F5 BIG-IP and BIG-IQ Centralized Management=4.6.0
F5 BIG-IQ Cloud and Orchestration>=4.0.0<=4.5.0
F5 BIG-IQ Cloud and Orchestration=1.0.0
F5 BIG-IQ Device>=4.2.0<=4.5.0
F5 BIG-IQ Security>=4.0.0<=4.5.0
F5 Enterprise Manager=3.1.1
F5 iWorkflow>=2.0.0<=2.3.0
360 MobileSafe=1.0.0
F5 WebSafe=1.0.0

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2014-5209?

    CVE-2014-5209 has a medium severity rating due to its potential for information disclosure.

  • How do I fix CVE-2014-5209?

    To address CVE-2014-5209, use the latest version of NTP or apply relevant patches as recommended by F5 or NTP maintainers.

  • What types of systems are affected by CVE-2014-5209?

    CVE-2014-5209 affects NTP version 4.2.7-p25 and various versions of F5 BIG-IP software including Access Policy Manager and Local Traffic Manager.

  • What does CVE-2014-5209 exploit?

    CVE-2014-5209 exploits vulnerabilities in NTP's handling of private messages, allowing unauthorized users to access confidential data.

  • Is there a workaround for CVE-2014-5209?

    A potential workaround for CVE-2014-5209 includes configuring access restrictions to limit the use of mode 6/7 messages in NTP.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203