Network Time Protocol CVE-2014-9296 Unspecified Security Vulnerability

Bugtraq ID:	71758
Class:	Unknown
CVE:	CVE-2014-9296
Remote:	Yes
Local:	No
Published:	Dec 19 2014 12:00AM
Updated:	Oct 26 2016 08:13AM
Credit:	Stephen Roettger and Neel Mehta of the Google Security Team.
Vulnerable:	Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE openSUSE Evergreen 11.4 SuSE Linux Enterprise Server 12 SuSE Linux Enterprise Desktop 12 Slackware Slackware Linux 14.1 Slackware Slackware Linux 14.0 Slackware Slackware Linux 13.37 Slackware Slackware Linux 13.1 Slackware Slackware Linux 13.0 S.u.S.E. openSUSE 13.2 S.u.S.E. openSUSE 13.1 S.u.S.E. openSUSE 12.3 Redhat Enterprise Linux Workstation Optional 7 Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 7 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 7 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 7 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Redhat Enterprise Linux ComputeNode Optional 7 Redhat Enterprise Linux ComputeNode 7 Redhat Enterprise Linux Client Optional 7 Redhat Enterprise Linux Client 7 Oracle Solaris 11.2 Oracle Solaris 11.1 Oracle Solaris 10 Oracle Enterprise Linux 7 Oracle Communications Policy Management 12.1.1 Oracle Communications Policy Management 10.4.1 Oracle Communications Policy Management 9.9.1 Oracle Communications Policy Management 9.7.3 Meinberg Network Time Protocol 4.2.7p10 Meinberg Network Time Protocol 4.2.7 Meinberg Network Time Protocol 4.2.6 Meinberg Network Time Protocol 4.2.5 Meinberg Network Time Protocol 4.2.4P8@Lennon-O-Lpv Meinberg Network Time Protocol 4.2.4P7@Copenhagen-O Meinberg Network Time Protocol 4.2.4 Meinberg Network Time Protocol 4.2.2 Meinberg Network Time Protocol 4.2.0 Meinberg Network Time Protocol 4.1.0 Meinberg Network Time Protocol 4.0 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Juniper vGW 0 Juniper Nsmexpress - Juniper NSM Server Software 0 Juniper NSM Series Appliances 0 Juniper NSM 0 Juniper JUNOS Space 0 Juniper Junos OS 14.2R1 Juniper Junos OS 14.1R2-S2 Juniper Junos OS 14.1R2 Juniper Junos OS 14.1R1 Juniper Junos OS 13.3R4 Juniper Junos OS 13.3R3-S2 Juniper Junos OS 13.3R3 Juniper Junos OS 13.3R2-S3 Juniper Junos OS 13.3R1 Juniper Junos OS 13.2X51-D25 Juniper Junos OS 13.2R5-S1 Juniper Junos OS 13.2R5 Juniper Junos OS 13.1X50-D30 Juniper Junos OS 13.1R4-S3 Juniper Junos OS 13.1R4-S2 Juniper Junos OS 12.3R8 Juniper Junos OS 12.3R7 Juniper Junos OS 12.2X50-D70 Juniper Junos OS 12.2R9 Juniper Junos OS 12.1X47-D15 Juniper Junos OS 12.1X47-D10 Juniper Junos OS 12.1X46-D25 Juniper Junos OS 12.1X46-D20 Juniper Junos OS 12.1X44-D40 Juniper Junos OS 11.4R12-S4 Juniper Junos OS 11.4R12-S1 Juniper Junos OS 0 Intel Xeon Phi 7120P Intel Xeon Phi 7120A Intel Xeon Phi 5110P Intel Xeon Phi 3120A Intel Manycore Platform Software Stack 3.4 Intel Manycore Platform Software Stack 3.3 Intel Manycore Platform Software Stack 3.2 Intel Manycore Platform Software Stack 3.1 Intel Manycore Platform Software Stack 2.1 IBM SmartCloud Entry 3.1 FP 9 IBM SmartCloud Entry 3.1 IBM Smart Analytics System 7710 0 IBM Smart Analytics System 7700 0 IBM Smart Analytics System 7600 0 IBM Security Network Protection (XGS) 7100 5.3 IBM Security Network Protection (XGS) 7100 5.2 IBM Security Network Protection (XGS) 5100 5.3 IBM Security Network Protection (XGS) 5100 5.2 IBM Security Network Protection (XGS) 4100 5.3 IBM Security Network Protection (XGS) 4100 5.2 IBM Security Network Protection (XGS) 3100 5.3 IBM Security Network Protection (XGS) 3100 5.2 IBM PureFlex x3950X6 IBM PureFlex x3850X6 IBM PureFlex x240m5+PEN IBM PureFlex x240m4 IBM PureFlex x220m4 IBM PureData System for Operational Analytics 1.1 (A1801) IBM PureData System for Operational Analytics 1.0 (A1791) IBM Power HMC 8.8.2.0 IBM Power HMC 8.8.1.0 IBM Power HMC 7.7.9.0 IBM Power HMC 7.7.8.0 IBM Power HMC 7.7.7.0 IBM Power HMC 7.7.3.0 IBM NeXtScale nx360m5 IBM NeXtScale nx360m4 IBM Netezza Host Management 5.3.3 IBM Netezza Host Management 5.3.2.0 IBM iDataPlex dx360m4 Huawei X8000 Rack V100R001C00 Huawei V1300N V100R002C02 Huawei Tecal XH621 V2 V100R001C00B010 Huawei Tecal XH320 V2 V100R001C00SPC105 Huawei Tecal XH311 V2 V100R001C00SPC100 Huawei Tecal XH310 V2 V100R001C00SPC100 Huawei RH5885H V3 V100R003C00 Huawei RH5885 V3 V100R003C01 Huawei RH5885 V2 V100R001C00 Huawei RH2485 V2 V100R002C00 Huawei RH2288H V2 V100R002C00 Huawei RH2288E V2 V100R002C00 Huawei RH2288 V2 V100R002C00 Huawei RH2285H V2 V100R002C00 Huawei RH2285 V2 V100R002C00 Huawei RH1288 V2 V100R002C00 Huawei OceanStor UDS V100R002C01 Huawei OceanStor UDS V100R002C00 Huawei OceanStor S6800T V200R002C00 Huawei OceanStor S5800T V200R002C00 Huawei OceanStor S5600T V100R002C00 Huawei OceanStor S5500T V200R002C00 Huawei OceanStor S2600T V200R002C00 Huawei OceanStor HVS88T V100R001C00 Huawei OceanStor HVS85T V100R001C00 Huawei OceanStor 18800F V100R001C00 Huawei OceanStor 18800 V100R001C00 Huawei High-Density Server DH628 V2 V100R001C00 Huawei High-Density Server DH621 V2 V100R001C00 Huawei High-Density Server DH620 V2 V100R001C00 Huawei High-Density Server DH320 V2 V100R001C00 Huawei FusionSphere OpenStack V100R005C00 Huawei Fusioncube V100R002C02SPC300 Huawei Fusioncube V100R002C02SPC200 Huawei Fusioncube V100R002C02SPC100 Huawei Fusioncube V100R002C01SPC100 Huawei FusionCompute V100R005C10 Huawei FusionCompute V100R005C00 Huawei FusionCompute V100R003C10 Huawei FusionCompute V100R003C00 Huawei FusionAccess V100R005C20 Huawei FusionAccess V100R005C10 Huawei eSpace VTM V100R002C00 Huawei eSpace VTM V100R001C30 Huawei eSpace VTM V100R001C02 Huawei eSpace VCN3000 V100R002C00 Huawei eSpace USM V200R003C00 Huawei eSpace UC V200R003C00 Huawei eSpace UC V200R002C01 Huawei eSpace UC V100R002C00 Huawei eSpace U2980 V200R003C00 Huawei eSpace U2980 V100R001C02SPC200 Huawei eSpace U2980 V100R001C01 Huawei eSpace IVS V100R001C02 Huawei eSpace DCM V100R002C01 Huawei eSpace DCM V100R001C03 Huawei eSpace DCM V100R001C02 Huawei eSpace DCM V100R001C01 Huawei eSpace CC V200R001C50 Huawei eSpace CC V200R001C32 Huawei eSpace CC V200R001C31 Huawei eSpace CC V200R001C03 Huawei eSpace CAD V100R001C01LHUE01 Huawei eSight UC&C V100R001C20 Huawei eSight UC&C V100R001C01 Huawei eSight NetWork V200R005C00 Huawei eSight NetWork V200R003C10 Huawei eSight NetWork V200R003C01 Huawei E9000 Chassis V100R001C00 Huawei E6000 Chassis V100R001C00 Huawei DC V100R002C01SPC001 HP Virtualization Performance Viewer 2.10 HP Virtualization Performance Viewer 2.01 HP Virtualization Performance Viewer 2.0 HP Virtualization Performance Viewer 1.2 HP Virtualization Performance Viewer 1.1 HP Virtualization Performance Viewer 1.0 HP TCP/IP Services for OpenVMS 5.7 HP HP-UX B.11.31 HP HP-UX B.11.23 Hitachi Advanced Server HA8000CR 0 Gentoo Linux FreeBSD FreeBSD 0 EMC ViPR SRM 3.6.0 EMC M&R 6.5 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Citrix NetScaler Gateway 0 Citrix Netscaler Application Delivery Controller 0 Cisco Wide Area Application Services (WAAS) 0 Cisco WebEx Social 0 Cisco WebEx Meetings Server 2.5 Base Cisco WebEx Meetings Server 2.5 Cisco WebEx Meetings Server 2.0MR2 Cisco WebEx Meetings Server 2.0 Cisco Virtualization Experience Client 6215 0 Cisco Virtual Systems Operations Center for vPE Project 0 Cisco Virtual Security Gateway 0 Cisco Videoscape Conductor 0 Cisco Videoscape Back Office (VBO) 0 Cisco Video Surveillance Media Server 0 Cisco Video Delivery System Recorder 0 Cisco Universal Small Cell RAN Management System Wireless 0 Cisco Unity Connection 0 Cisco Unified SIP Proxy 0 Cisco Unified Provisioning Manager 8.6 Cisco Unified MeetingPlace 0 Cisco Unified Intelligence Center (CUIC) 0 Cisco Unified Contact Center Express (UCCX) 0 Cisco Unified Communications Manager (CUCM) 0 Cisco Unified Communications Domain Manager 0 Cisco UCS Manager 0 Cisco UCS Invicta Series 0 Cisco UCS Director 0 Cisco Transaction Encryption Device (TED) 0 Cisco TelePresence TX 9000 Series 0 Cisco TelePresence TE Software (for E20 - EoL) 0 Cisco TelePresence System 500-37 0 Cisco TelePresence System 500-32 0 Cisco TelePresence System 3000 Series 0 Cisco TelePresence System 1300 0 Cisco TelePresence System 1100 0 Cisco TelePresence System 1000 0 Cisco TelePresence Profile Series 0 Cisco TelePresence ISDN Link 0 Cisco TelePresence 1310 0 Cisco Service Control Engines System Software 0 Cisco SCOS (Service Control Operating System) 0 Cisco Remote Network Control System (RNCS) 0 Cisco Remote Conditional Access System (RCAS) 0 Cisco Quantum SON Suite 0 Cisco Quantum Policy Suite (QPS) 0 Cisco Prime Service Catalog Virtual Appliance 0 Cisco Prime License Manager 0 Cisco Prime LAN Management Solution 0 Cisco Prime Infrastructure - Cisco Prime Data Center Network Manager 0 Cisco Prime Collaboration Provisioning 0 Cisco PowerVu Network Center 0 Cisco PowerVu D9190 Conditional Access Manager (PCAM) 0 Cisco Powerkey Encryption Server (PKES) 0 Cisco Physical Access Manager 0 Cisco Paging Server (Informacast) 0 Cisco Paging Server 0 Cisco OnePK All-in-One VM 0 Cisco Nexus 9000 Series Switches 0 Cisco Nexus 7000 Series Switches 0 Cisco Nexus 6000 Series Switches 0 Cisco Nexus 5000 Series Switches 0 Cisco Nexus 4000 Series Switches 0 Cisco Nexus 3000 Series Switches 0 Cisco Nexus 1000V Series Switches 0 Cisco Network Configuration and Change Management Service 0 Cisco Network Configuration and Change Management 0 Cisco NetFlow Collection Agent 0 Cisco MediaSense 0 Cisco Media Experience Engines (MXE) 0 Cisco MDS 9000 Series Multilayer Switches 0 Cisco Management Heartbeat Server 0 Cisco Jabber Guest 0 Cisco IPTV Service Delivery System (ISDS) 0 Cisco IP Interoperability and Collaboration System (IPICS) 0 Cisco IOS XR Software 0 Cisco IOS XR for Cisco Network Convergence System (NCS) 6000 0 Cisco International Digital Network Control System (iDNCS) 0 Cisco Intelligent Automation for Cloud 0 Cisco IM and Presence Service (CUPS) 0 Cisco FireSIGHT System Software 0 Cisco Finesse 0 Cisco Explorer Controller (EC) 0 Cisco Enterprise Content Delivery Service 0 Cisco Encryption Appliance (IEA) 0 Cisco Emergency Responder 0 Cisco Emergency Responder Cisco Edge 300 Digital Media Player 0 Cisco Download Server (DLS) (Sparc Based) 0 Cisco Download Server (DLS) (Linux Based) 0 Cisco DNCS Application Server (AppServer) 0 Cisco Digital Transport Adapter Control System (DTACS) 0 Cisco Digital Network Control System (DNCS) 0 Cisco Digital Media Manager (DMM) 0 Cisco DCM Series 9900-Digital Content Manager 0 Cisco D9036 Modular Encoding Platform 0 Cisco Common Services Platform Collector 0 Cisco Common Download Server (CDLS) 0 Cisco Command 2000 Server (cmd2k) 0 Cisco Cloud Object Store (COS) 0 Cisco Cisco Telepresence endpoints SX series 0 Cisco Cisco Telepresence endpoints MXG2 series 0 Cisco Cisco Telepresence endpoints MX series 0 Cisco Cisco Telepresence endpoints EX series 0 Cisco Cisco Telepresence endpoints C series 0 Cisco Cisco Telepresence endpoints 10" touch panel 0 Cisco Cisco IronPort Encryption Appliance (IEA) 0 Cisco Cisco Edge 300 Digital Media Player 0 Cisco Cisco Application Policy Infrastructure Controller 0 Cisco AutoBackup Server 0 Cisco ASA CX and Cisco Prime Security Manager 0 Cisco Application Networking Manager (ANM) 0 Cisco Application and Content Networking System (ACNS) 0 CentOS CentOS 7 Avaya one-X Client Enablement Services 6.2 SP2 Avaya one-X Client Enablement Services 6.2 Avaya IP Office Server Edition 9.0 Avaya IP Office Server Edition 8.1 Avaya IP Office Application Server 9.0 SP 2 Avaya IP Office Application Server 9.0 SP 1 Avaya IP Office Application Server 9.0 Avaya CMS r17 Avaya Aura Session Manager 6.3.1 Avaya Aura Session Manager 6.3.3 Avaya Aura Session Manager 6.3 Avaya Aura Experience Portal 6.0.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0.1 Avaya Aura Experience Portal 7.0 Avaya Aura Experience Portal 6.0 SP2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0 SP1 Avaya Aura Experience Portal 6.0 Avaya Aura Conferencing 8.0 Avaya Aura Collaboration Environment 3.0 Avaya Aura Collaboration Environment 2.0
Not Vulnerable:	Meinberg Network Time Protocol 4.2.8 Juniper Junos OS 14.2R3 Juniper Junos OS 14.1X55-D16 Juniper Junos OS 14.1X50-D90 Juniper Junos OS 14.1R5 Juniper Junos OS 13.3R6 Juniper Junos OS 13.2R8 Juniper Junos OS 12.3X48-D15 Juniper Junos OS 12.3R9 Juniper Junos OS 12.1X47-D20 Juniper Junos OS 12.1X46-D35 Juniper Junos OS 12.1X44-D50 IBM SmartCloud Entry 3.1 FP 10 EMC ViPR SRM 3.6.1 EMC M&R 6.5u1

Network Time Protocol CVE-2014-9296 Unspecified Security Vulnerability

Network Time Protocol is prone to an unspecified security vulnerability.

Little is known about this issue or its effects at this time. We will update this BID as more information emerges.

Network Time Protocol 4.2.7 is vulnerable; other versions may also be affected.

Network Time Protocol CVE-2014-9296 Unspecified Security Vulnerability

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Network Time Protocol CVE-2014-9296 Unspecified Security Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Network Time Protocol CVE-2014-9296 Unspecified Security Vulnerability

References:

• Multiple vulnerabilities in NTP (Oracle)
  
• NTP Homepage (ntp.org)
  
• Out of Cycle Security Bulletin: Multiple vulnerabilities in NTP (Juniper)
  
• Security Notice-Statement on NTP.org and CERT/CC Revealing Security Vulnerabilit (Huawei)
  
• (ICSA-14-353-01) Network Time Protocol Vulnerabilities (CERT)
  
• Citrix Security Advisory for NTP Vulnerabilities (Citrix)
  
• Critical Patch Security Advisory - October 2016 (Oracle)
  
• ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities (EMC)
  
• FreeBSD-SA-14:31.ntp Multiple vulnerabilities in NTP suite (FreeBSD)
  
• HPSBGN03277 rev.1 - HP Virtualization Performance Viewer, Remote Execution of Co (HP)
  
• HPSBOV03505 rev.1 - TCP/IP Services for OpenVMS running NTP, Remote Code Executi (HP)
  
• HPSBUX03240 SSRT101872 rev.1 - HP-UX Running NTP, Remote Execution of Code, Deni (HP)
  
• IBM Netezza Host Management NTP vulnerabilities (CVE-2014-9293, CVE-2014-9294, C (IBM)
  
• ICSA-14-353-01A Network Time Protocol Vulnerabilities (Update A) (CERT)
  
• Multiple Vulnerabilities in ntpd Affecting Cisco Products (Cisco)
  
• ntp security update (RHSA-2014-2024) (Avaya)
  
• NTP vulnerabilities affect IBM SmartCloud Entry (IBM)
  
• Security Bulletin: IBM Security Network Protection is affected by NTP vulnerabil (IBM)
  
• Security Bulletin: Multiple Vulnerabilities in Network Time Protocol (NTP) Affec (IBM)
  
• Security Bulletin: Security Vulnerabilities in Network Time Protocol Daemon affe (IBM)
  
• swg21966675: IBM Smart Analytics System 7600, 7700, 7710 and IBM PureData System (IBM)
  
• VU#852879 Network Time Protocol daemon (ntpd) contains multiple vulnerabilities (CERT)
  
• Vulnerability (CVE-2014-9293~9296) in Network Time Protocol daemon (ntpd) for Se (Hitachi)