| Description: | Neel Mehta discovered that NTP generated weak authentication keys. A remoteattacker could possibly use this issue to brute force the authenticationkey and send requests if permitted by IP restrictions. (CVE-2014-9293)Stephen Roettger discovered that NTP generated weak MD5 keys. A remoteattacker could possibly use this issue to brute force the MD5 key and spoofa client or server. (CVE-2014-9294)Stephen Roettger discovered that NTP contained buffer overflows in thecrypto_recv(), ctl_putdata() and configure() functions. In non-defaultconfigurations, a remote attacker could use these issues to cause NTP tocrash, resulting in a denial of service, or possibly execute arbitrarycode. The default compiler options for affected releases should reduce thevulnerability to a denial of service. In addition, attackers would beisolated by the NTP AppArmor profile. (CVE-2014-9295)Stephen Roettger discovered that NTP incorrectly continued processing whenhandling certain errors. (CVE-2014-9296) |