| Name | CVE-2014-5209 |
| Description | An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| ntp (PTS) | jessie, jessie (lts) | 1:4.2.6.p5+dfsg-7+deb8u3 | vulnerable |
| stretch | 1:4.2.8p10+dfsg-3+deb9u2 | fixed |
| buster | 1:4.2.8p12+dfsg-4 | fixed |
| bullseye | 1:4.2.8p15+dfsg-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| ntp | source | (unstable) | 1:4.2.8p3+dfsg-1 | | | |
Notes
[jessie] - ntp <ignored> (can be worked around by disabling mode in configuration)
Starting with 4.2.8, mode 7 is marked as deprecated and disabled by default,
treat this as the fixed version here.
http://bk.ntp.org/ntp-stable/?PAGE=patch&REV=4eae26a46gF81Tr6RRrYnf6jWhVo0g
http://bk.ntp.org/ntp-stable/?PAGE=patch&REV=4eb4b512O-jx-s-epS2A75g9mitvfQ
[wheezy] - ntp <ignored> (can be worked around by disabling mode in configuration)