What’s Vulnerable › Vulnerabilities

CVE-2014-9751

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-10-06 · updated 2026-06-17
• Weakness: CWE-20

Description

The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address.

Affected products

• Debian Linux: 7.0, 8.0, 9.0
• NTP: from 4.2.0 before 4.2.8; 4.2.8 — fixed in 4.2.8
• Oracle Corporation Oracle Linux: 7
• RedHat Enterprise Linux Desktop: 6.0
• RedHat Enterprise Linux Server: 6.0
• RedHat Enterprise Linux Workstation: 6.0

How to fix

Upgrade to a fixed version: NTP 4.2.8. Check the vendor advisory for mitigations.

References

• http://bugs.ntp.org/show_bug.cgi?id=2672
• http://rhn.redhat.com/errata/RHSA-2015-1459.html
• http://support.ntp.org/bin/view/Main/SecurityNotice#December_2014_NTP_Security_Vulne
• http://www.debian.org/security/2015/dsa-3388
• http://www.kb.cert.org/vuls/id/852879
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• http://www.securityfocus.com/bid/72584
• https://bugzilla.redhat.com/show_bug.cgi?id=1184572
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us
• http://bugs.ntp.org/show_bug.cgi?id=2672
• http://rhn.redhat.com/errata/RHSA-2015-1459.html
• http://support.ntp.org/bin/view/Main/SecurityNotice#December_2014_NTP_Security_Vulne

Get alerted when CVE-2014-9751 or the next vulnerability affects your stack