CVE-2014-9750: Input Validation
ntpcrypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9750?
CVE-2014-9750 has been assigned a severity level that could lead to sensitive data exposure or denial of service.
How do I fix CVE-2014-9750?
To fix CVE-2014-9750, update your NTP software to version 4.2.8p1 or later.
Which versions of NTP are affected by CVE-2014-9750?
CVE-2014-9750 affects NTP 4.x versions prior to 4.2.8p1 when Autokey Authentication is enabled.
What exploit does CVE-2014-9750 allow?
CVE-2014-9750 allows remote attackers to exploit an invalid packet extension field, potentially leading to sensitive information disclosure or service interruptions.
Is CVE-2014-9750 relevant for my Linux distribution?
CVE-2014-9750 is relevant for various Linux distributions, including Red Hat and Debian, particularly impacting specific versions.