REDHAT-BUG-1184573
First published: Wed Jan 21 2015(Updated: )
It was reported [1] that ntp miss validation of vallen value, leading to various info leaks: * ntpd/ntp_crypto.c:571 * ntpd/ntp_crypto.c:1162 * ntpd/ntp_crypto.c:1559 * ntpd/ntp_crypto.c:2117 * ntpd/ntp_crypto.c:1461 Upstream commits that fixes this: <a href="http://bk.ntp.org/ntp-stable/?PAGE=patch&REV=5492d353ncauuWt_PONxaDhC5Qv_SA">http://bk.ntp.org/ntp-stable/?PAGE=patch&REV=5492d353ncauuWt_PONxaDhC5Qv_SA</a> <a href="http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=54abb266In81wLNAqIaovtP8f2UmUw">http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=54abb266In81wLNAqIaovtP8f2UmUw</a> <a href="http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=54a7c595jlwS3KmAxBML75HFGLR_pQ">http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=54a7c595jlwS3KmAxBML75HFGLR_pQ</a> [1]: <a href="http://bugs.ntp.org/2671">http://bugs.ntp.org/2671</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| NTP |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bk.ntp.org/ntp-stable/?PAGE=patch&REV=5492d353ncauuWt_PONxaDhC5Qv_SA
- http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=54abb266In81wLNAqIaovtP8f2UmUw
- http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=54a7c595jlwS3KmAxBML75HFGLR_pQ
- http://bugs.ntp.org/2671
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1189406
- http://support.ntp.org/bin/view/Main/SecurityNotice#vallen_is_not_validated_in_sever
- https://access.redhat.com/support/policy/updates/errata/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1184573#c16
- https://rhn.redhat.com/errata/RHSA-2015-1459.html
- https://access.redhat.com/security/cve/CVE-2014-9297
- https://access.redhat.com/security/cve/CVE-2014-9298
- https://access.redhat.com/security/cve/CVE-2014-9750
- https://rhn.redhat.com/errata/RHSA-2015-2231.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1184573
Frequently Asked Questions
What is the severity of REDHAT-BUG-1184573?
The severity of REDHAT-BUG-1184573 is classified as high due to the potential for information leaks.
How do I fix REDHAT-BUG-1184573?
To fix REDHAT-BUG-1184573, ensure that you apply the upstream patches that address the validation issues in ntp.
What software is affected by REDHAT-BUG-1184573?
REDHAT-BUG-1184573 affects the NTP (Network Time Protocol) software.
What are the risks of not addressing REDHAT-BUG-1184573?
Not addressing REDHAT-BUG-1184573 can lead to information exposure and potential exploitation of the NTP service.
Is there a workaround for REDHAT-BUG-1184573?
Currently, there are no official workarounds for REDHAT-BUG-1184573, so applying the patch is essential.
- collector/redhat-bugzilla
- alias/CVE-2014-9297
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/description
- agent/softwarecombine
- agent/tags
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/ntp
- canonical/ntp