topic Re: NTP Vuln - Cert VU#852879 / CVE-2014-9295 in General Topics

NTP Vuln - Cert VU#852879 / CVE-2014-9295

cmcguire-coactive — Sun, 21 Dec 2014 02:58:36 GMT

Network Time Protocol Vulnerabilities | ICS-CERT

http://support.ntp.org/bin/view/Main/SecurityNotice

access.redhat.com | CVE-2014-9295

http://arstechnica.com/security/2014/12/attack-code-exploiting-critical-bugs-in-net-time-sync-puts-servers-at-risk/

Re: NTP Vuln - Cert VU#852879 / CVE-2014-9295

bat — Wed, 24 Dec 2014 08:58:41 GMT

coactive

I think this has been covered in Content release 478

Re: NTP Vuln - Cert VU#852879 / CVE-2014-9295

Retired Member — Wed, 24 Dec 2014 11:02:55 GMT

I can confirm, IPS signature for CVE-2014-9295 is included in content update 478.

Re: NTP Vuln - Cert VU#852879 / CVE-2014-9295

pulukas — Sat, 27 Dec 2014 15:57:08 GMT

When you have a threat id number the best place to check is the threat vault. Simply search on the number and it will return where the signature exists if there is one.

https://threatvault.paloaltonetworks.com/

Ntpd Remote Buffer Overflow Vulnerability

Signature ID : 37198

Description	Ntp daemon 4.2.7 and earlier are prone to a buffer overflow vulnerability while parsing certain crafted NTP requests. The vulnerability is due to the lack of boundary checks while parsing certain arguments passed in a request. It could lead to an exploitable stack overflow. An attacker could exploit the vulnerability by sending a crafted NTP request that could allow remote code execution with the privileges of the server.
References	http://www.kb.cert.org/vuls/id/852879
Severity	critical
Category	overflow
Default action	alert
CVE	CVE-2014-9295