CVE-2014-9293: High severity ntp vulnerability
As per upstream NTP security advisory:
If no 'auth' key is set in the configuration file, ntpd would generate a random key on the fly. There were two problems with this: 1) the generated key was 31 bits in size, and 2) it used the (now weak) ntprandom() function, which was seeded with a 32-bit value and could only provide 32 bits of entropy. This was sufficient back in the late 1990s when the code was written. Not today.
Mitigation: Upgrade to 4.2.7p11 or later.
This vulnerability was noticed in ntp-4.2.6 by Neel Mehta of the Google Security Team.
Other sources
The configauth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9293?
The severity of CVE-2014-9293 has been categorized as high due to the potential for attackers to exploit weak random keys.
How do I fix CVE-2014-9293?
To fix CVE-2014-9293, upgrade your NTP software to version 4.2.8 or later.
What systems are affected by CVE-2014-9293?
CVE-2014-9293 affects NTP versions up to 4.2.7 across various platforms.
What is the risk if CVE-2014-9293 is not addressed?
If CVE-2014-9293 is not addressed, unauthorized users may have an increased risk of intercepting and spoofing NTP traffic.
What is the cause of CVE-2014-9293?
CVE-2014-9293 is caused by NTP's weak random key generation when no authentication keys are configured.