Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.2519
Multiple Vulnerabilities in ntpd Affecting Cisco Products
24 December 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cisco products
Publisher: Cisco Systems
Operating System: Cisco
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Access Privileged Data -- Existing Account
Denial of Service -- Remote/Unauthenticated
Provide Misleading Information -- Existing Account
Reduced Security -- Existing Account
Resolution: Mitigation
CVE Names: CVE-2014-9296 CVE-2014-9295 CVE-2014-9294
CVE-2014-9293
Reference: ASB-2014.0145
ESB-2014.2476
ESB-2014.2473
ESB-2014.2472
Original Bulletin:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141222-ntpd
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Multiple Vulnerabilities in ntpd Affecting Cisco
Products
Advisory ID: cisco-sa-20141222-ntpd
Revision 1.1
Last Updated 2014 December 23 13:37 UTC (GMT)
For Public Release 2014 December 22 16:00 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Multiple Cisco products incorporate a version of the ntpd package. Versions
of this package are affected by one or more vulnerabilities that could allow
an unauthenticated, remote attacker to execute arbitrary code or create a
denial of service (DoS) condition.
On December 19, 2014, NTP.org and US-CERT released security advisories
detailing two issues regarding weak cryptographic pseudorandom number
generation (PRNG), three buffer overflow vulnerabilities, and an unhandled
error condition with an unknown impact. The vulnerabilities are referenced
in this document as follows:
* CVE-2014-9293: Weak Default Key in config_auth()
* CVE-2014-9294: Noncryptographic Random Number Generator with Weak Seed
Used by ntp-keygen to Generate Symmetric Keys
* CVE-2014-9295: Multiple Buffer Overflow Vulnerabilities in ntpd
* CVE-2014-9296: ntpd receive(): Missing Return on Error
This advisory will be updated as additional information becomes available.
Cisco will release free software updates that address these vulnerabilities.
Workarounds that mitigate these vulnerabilities are available.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s
a-20141222-ntpd
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)
iQIVAwUBVJn5jopI1I6i1Mx3AQIgig/+Pwng8NnetF1akKCYNBHhmBPp+TZsILzD
gchFJT9pewtbL+tjWy7lWerXfFS8VrSd4EqJM5T7dawuw7I6EOUusSsyC9f1boIT
iqgL204OwH92C8VVcHfFoQn7A5HVGcJDtriwZvNt+nrsEPUEkMyB6E1cQPe3lQHg
yeGQRnl8JH7E4Teo2HttmLUAWQ8bQfKXzS1R5aT53TXTR7Fnwl3oc/DApAZu7KiG
C5MF3ZCNXF8PxtnKlo6rp38CofzM6GYhUgFngC3yGlQPKNuAr8UeoZAsDhkbSTMH
XU6RPZW9O+GOTIeWGj3TH+ywE8D7gNwRHy3R20h6edY29w+lq+uI2DQAzJfx+0Ut
Sb2362a2vPinrSEAMZUMZ8HA90g+uFt2PzWE+/mX/iQ9R0wqoahwF5L5f5TOdhaE
xqydVm/p4dgUx4axgDoTES7rANheGV+87xHYBgIhfynEUBB6BCrzAaFndgMti8h1
r8kmNLzJNV6A13LPoimvtec+WFQoEFlmHj2cpPG1wGsogeMrDck0h3t6VagiSh6T
w9rS2unkcTekTe/r+rUcDG2FlujhDlhv8hmtwfPO8OIUwo4W1NaTDMzHXobfG851
piw3zjAvMySLWZK9BswmaIwL7HnRap9xtmDOGiPGEi1AqI8QMkzEXJAYHMbmX/IO
FSCtrcV2J2o=
=Ohet
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVJosPBLndAQH1ShLAQKjyg//Rambx91bgrFsU6sZof6pQZ1GdSSfDIpo
RyqKMCl8sGzp+10VT33zW6H2gpBgzsI0kP25oxfN4OzRL2KWza3JdL2oZpoSnWyy
+lFIUsUF+4doe46nJcRbPdEz9HNQnAOTw4ZePW8qC10uxOWl9BjDdP0CwOFOXJ9V
6K1qJvq6J74Usz1nKgpUYi8+JQAFeMdB43R2co0pSbDOFO3hWUAzBkQ5KzO546Ol
tANj1TG8Yo8v6tjflZ0xDh8u60xGysefJcYQrhWuGNEXcQ3cxCw1YNUylaJzC/Rv
0q9fCV1sCxJHY4hCC24ojE7TuX8zAgIyTQ9HqDfI9+oX259RtuHzWLy/7S+8LpEq
+CMHyIzfAj6rSFzwpWb2ngc6xG8DDwOARpAZBBE5yyM7TGFDtSZ+HAcS5MXA8GLJ
rIh/tI5pYEpzgXaDDDooLhbv/pnK/gIdhzHI3cYN/1ZMJEE5swmRgQJm5sXRMQyP
l1aUBhCoQwKOMqXAg8GC8bjLEt2nghSx16IJjaIerJplfa8FqTftzcUSvE7Sg6Fl
dxhpqEuaXD6OqnBscSAQh8a+PKFE3/FFz7po4sw8JfBezENOuhN+0sGXmAXHqL60
I0CdA2sT+h/aogHIeEyto0QUAhvUTmH9cbycVVE/QuyRhwrvzp3oUeDmTEte3bjx
sr3zGdLE2v0=
=9a81
-----END PGP SIGNATURE-----