CVE-2014-9295

Published: 19 December 2014

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.

Notes

Author	Note
mdeslaur	configure() isn't in lucid

Priority

Status

Package	Release	Status
ntp Launchpad, Ubuntu, Debian	lucid	Released (1:4.2.4p8+dfsg-1ubuntu2.2)
	precise	Released (1:4.2.6.p3+dfsg-1ubuntu3.2)
	trusty	Released (1:4.2.6.p5+dfsg-3ubuntu2.14.04.1)
	upstream	Released (4.2.8)
	utopic	Released (1:4.2.6.p5+dfsg-3ubuntu2.14.10.1)
	Patches: upstream: http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acc4dN1TbM1tRJrbPcA4yc1aTdA upstream: http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acdf3tUSFizXcv_X4b77Jt_Y-cg upstream: http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acf55dxKfhb6MuYQwzu8eDlS97g
	This vulnerability is mitigated in part by an AppArmor profile. This vulnerability is mitigated in part by the use of gcc's stack protector in Ubuntu.

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Security