CVE-2014-5209: Infoleak
Published Jan 8, 2020
·Updated
An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GETRESTRICT control message, which could let a malicious user obtain sensitive information.
Affected Software
77 affected components
NTP ntp=4.2.7-p25
F5 BIG-IP Access Policy Manager>=10.2.1<=10.2.4
F5 BIG-IP Access Policy Manager>=11.4.0<=11.6.4
F5 BIG-IP Access Policy Manager>=12.0.0<=12.1.4
F5 BIG-IP Access Policy Manager>=13.0.0<=13.1.1
F5 BIG-IP Access Policy Manager>=14.0.0<=14.1.0
F5 BIG-IP Access Policy Manager=11.2.1
F5 BIG-IP Access Policy Manager=15.0.0
F5 BIG-IP Advanced Firewall Manager>=11.4.0<=11.6.4
F5 BIG-IP Advanced Firewall Manager>=12.0.0<=12.1.4
F5 BIG-IP Advanced Firewall Manager>=13.0.0<=13.1.1
F5 BIG-IP Advanced Firewall Manager>=14.0.0<=14.1.0
F5 BIG-IP Advanced Firewall Manager=15.0.0
F5 BIG-IP Analytics>=11.4.0<=11.6.4
F5 BIG-IP Analytics>=12.0.0<=12.1.4
F5 BIG-IP Analytics>=13.0.0<=13.1.1
F5 BIG-IP Analytics>=14.0.0<=14.1.0
F5 BIG-IP Analytics=11.2.1
F5 BIG-IP Analytics=15.0.0
F5 Big-ip Application Acceleration Manager>=11.4.0<=11.6.4
F5 Big-ip Application Acceleration Manager>=12.0.0<=12.1.4
F5 Big-ip Application Acceleration Manager>=13.0.0<=13.1.1
F5 Big-ip Application Acceleration Manager>=14.0.0<=14.1.0
F5 Big-ip Application Acceleration Manager=15.0.0
F5 BIG-IP Application Security Manager>=10.2.1<=10.2.4
F5 BIG-IP Application Security Manager>=11.4.0<=11.6.4
F5 BIG-IP Application Security Manager>=12.0.0<=12.1.4
F5 BIG-IP Application Security Manager>=13.0.0<=13.1.1
F5 BIG-IP Application Security Manager>=14.0.0<=14.1.0
F5 BIG-IP Application Security Manager=11.2.1
F5 BIG-IP Application Security Manager=15.0.0
F5 Big-ip Domain Name System>=12.0.0<=12.1.4
F5 Big-ip Domain Name System>=13.0.0<=13.1.1
F5 Big-ip Domain Name System>=14.0.0<=14.1.0
F5 Big-ip Domain Name System=15.0.0
F5 BIG-IP Edge Gateway>=10.2.1<=10.2.4
F5 BIG-IP Edge Gateway=11.2.1
F5 Big-ip Global Traffic Manager>=10.2.1<=10.2.4
F5 Big-ip Global Traffic Manager>=11.4.0<=11.6.4
F5 Big-ip Global Traffic Manager=11.2.1
F5 Big-ip Link Controller>=10.2.1<=10.2.4
F5 Big-ip Link Controller>=11.4.0<=11.6.4
F5 Big-ip Link Controller>=12.0.0<=12.1.4
F5 Big-ip Link Controller>=13.0.0<=13.1.1
F5 Big-ip Link Controller>=14.0.0<=14.1.0
F5 Big-ip Link Controller=11.2.1
F5 Big-ip Link Controller=15.0.0
F5 Big-ip Local Traffic Manager>=10.2.1<=10.2.4
F5 Big-ip Local Traffic Manager>=11.4.0<=11.6.4
F5 Big-ip Local Traffic Manager>=12.0.0<=12.1.4
F5 Big-ip Local Traffic Manager>=13.0.0<=13.1.1
F5 Big-ip Local Traffic Manager>=14.0.0<=14.1.0
F5 Big-ip Local Traffic Manager=11.2.1
F5 Big-ip Local Traffic Manager=15.0.0
F5 Big-ip Policy Enforcement Manager>=11.4.0<=11.6.4
F5 Big-ip Policy Enforcement Manager>=12.0.0<=12.1.4
F5 Big-ip Policy Enforcement Manager>=13.0.0<=13.1.1
F5 Big-ip Policy Enforcement Manager>=14.0.0<=14.1.0
F5 Big-ip Policy Enforcement Manager=15.0.0
F5 Big-ip Protocol Security Module>=10.2.1<=10.2.4
F5 Big-ip Protocol Security Module>=11.4.0<=11.4.1
F5 Big-ip Wan Optimization Manager>=10.2.1<=10.2.4
F5 Big-ip Wan Optimization Manager=11.2.1
F5 Big-ip Webaccelerator>=10.2.1<=10.2.4
F5 Big-ip Webaccelerator=11.2.1
F5 BIG-IQ ADC=4.5.0
F5 BIG-IQ Centralized Management>=5.0.0<=5.4.0
F5 BIG-IQ Centralized Management>=6.0.0<=6.1.0
F5 BIG-IQ Centralized Management=4.6.0
F5 BIG-IQ Cloud>=4.0.0<=4.5.0
F5 BIG-IQ Cloud and Orchestration=1.0.0
F5 BIG-IQ Device>=4.2.0<=4.5.0
F5 BIG-IQ Security>=4.0.0<=4.5.0
F5 Enterprise Manager=3.1.1
F5 iWorkflow>=2.0.0<=2.3.0
F5 Mobilesafe=1.0.0
F5 Websafe=1.0.0
Event History
Jan 8, 2020
CVE Published
via MITRE·12:29 AM
Data Sourced
via MITRE·12:29 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2014-5209?
CVE-2014-5209 has a medium severity rating due to its potential for information disclosure.
2
How do I fix CVE-2014-5209?
To address CVE-2014-5209, use the latest version of NTP or apply relevant patches as recommended by F5 or NTP maintainers.
3
What types of systems are affected by CVE-2014-5209?
CVE-2014-5209 affects NTP version 4.2.7-p25 and various versions of F5 BIG-IP software including Access Policy Manager and Local Traffic Manager.
4
What does CVE-2014-5209 exploit?
CVE-2014-5209 exploits vulnerabilities in NTP's handling of private messages, allowing unauthorized users to access confidential data.
5
Is there a workaround for CVE-2014-5209?
A potential workaround for CVE-2014-5209 includes configuring access restrictions to limit the use of mode 6/7 messages in NTP.