CVE-2014-9751

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.ntp.org/show_bug.cgi?id=2672Issue Tracking, Patch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1459.htmlThird Party Advisory
http://support.ntp.org/bin/view/Main/SecurityNotice#December_2014_NTP_Security_VulneVendor Advisory
http://www.debian.org/security/2015/dsa-3388Third Party Advisory
http://www.kb.cert.org/vuls/id/852879Third Party Advisory, US Government Resource
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
http://www.securityfocus.com/bid/72584Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1184572Issue Tracking, Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_usThird Party Advisory
http://bugs.ntp.org/show_bug.cgi?id=2672Issue Tracking, Patch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1459.htmlThird Party Advisory
http://support.ntp.org/bin/view/Main/SecurityNotice#December_2014_NTP_Security_VulneVendor Advisory
http://www.debian.org/security/2015/dsa-3388Third Party Advisory
http://www.kb.cert.org/vuls/id/852879Third Party Advisory, US Government Resource
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
http://www.securityfocus.com/bid/72584Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1184572Issue Tracking, Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_usThird Party Advisory

Timeline

Published: Oct 6, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-97526.5Unrestricted file upload vulnerability in mods/_core/properties/lib/course.inc.php in ATutor before 2.2 patch 6 allows remote authenticated CVE-2014-97539.8confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_logi CVE-2014-97545.9The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint ident CVE-2014-97557.5The hardware VPN client in Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint ident CVE-2014-97565.0The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash CVE-2014-97579.8The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers CVE-2014-97586.1Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1.CVE-2014-97595.3Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attacker CVE-2014-97606.1Cross-site scripting (XSS) vulnerability in the displayLogin function in html/index.php in GOsa allows remote attackers to inject arbitrary CVE-2014-97619.8Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a den CVE-2014-97627.5imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap.CVE-2014-97637.5imlib2 before 1.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted PNM file