CVE-2014-9293
Description
It was found that ntpd automatically generated weak keys for its internal use if no ntpdc request authentication key was specified in the ntp.conf configuration file. A remote attacker able to match the configured IP restrictions could guess the generated key, and possibly use it to send ntpdc query or configuration requests.
Mitigation
Issue these commands to explicitly generate a strong key and add it to the
ntpd configuration:
echo trustedkey 65535 >> /etc/ntp.conf
printf "65535\tM\t%s\n" $(tr -cd a-zA-Z0-9 < /dev/urandom | head -c 16) >> /etc/ntp/keys
The generated key has about 95 bits of entropy.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v2 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Access Complexity | High | Low | N/A |
| Authentication | None | None | N/A |
| Confidentiality Impact | Partial | Partial | N/A |
| Integrity Impact | Partial | Partial | N/A |
| Availability Impact | None | Partial | N/A |
Vector
Red Hat: AV:N/AC:H/Au:N/C:P/I:P/A:N
NVD: AV:N/AC:L/Au:N/C:P/I:P/A:P
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
If a PRNG is used for authentication and authorization, such as a session ID or a seed for generating a cryptographic key, then an attacker may be able to easily guess the ID or cryptographic key and gain access to restricted functionality.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
