CVE-2014-9295

Exp

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.

Published: 2014-12-20 Last update: 2026-05-06 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2014-9295 is rated High Exploit Risk (78.6/100): CVSS High severity, with high exploitation likelihood (EPSS 57.27%, 98th percentile). Core evidence: 3 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2014-9295

EDB-ID Source Kind Published Link
nvd_ref exploit_tag Exploit-DB ↗
nvd_ref exploit_tag Exploit-DB ↗
nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2014-9295

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-03-18 57.98% 57.27% -0.71%
2 2026-01-18 65.58% 57.98% -7.59%
3 2026-01-11 65.58%

Full EPSS history (16 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2014-9295

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 2.0 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
10.0 6.4 [email protected]

Weakness enumeration for CVE-2014-9295

OS Trackers for CVE-2014-9295

vendor priority summary link
debian not yet assigned CVE-2014-9295 not yet assigned priority: Debian including 1 source packages (ntp), 1 status rows across 1 suites (bullseye): resolved 1. https://security-tracker.debian.org/tracker/CVE-2014-9295
gentoo high CVE-2014-9295: 1 GLSA(s) (201412-34), 1 atom(s) (net-misc/ntp); latest impact high. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2014-9295
redhat high https://access.redhat.com/security/cve/CVE-2014-9295
ubuntu medium CVE-2014-9295 medium priority: Ubuntu including 1 source packages (ntp), 5 status rows across 5 suites (lucid, precise, trusty, upstream, utopic): released 5. https://ubuntu.com/security/CVE-2014-9295

Affected software / configurations for CVE-2014-9295

Vendor Product Version Raw CPE
ntp ntp <= 4.2.7 cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*

References for CVE-2014-9295

URL Tags
http://advisories.mageia.org/MGASA-2014-0541.html
http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acc4dN1TbM1tRJrbPcA4yc1aTdA Exploit
http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acdf3tUSFizXcv_X4b77Jt_Y-cg Exploit
http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=548acf55dxKfhb6MuYQwzu8eDlS97g Exploit
http://bugs.ntp.org/show_bug.cgi?id=2667
http://bugs.ntp.org/show_bug.cgi?id=2668
http://bugs.ntp.org/show_bug.cgi?id=2669
http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00020.html
http://marc.info/?l=bugtraq&m=142469153211996&w=2
http://marc.info/?l=bugtraq&m=142590659431171&w=2
http://marc.info/?l=bugtraq&m=142853370924302&w=2
http://marc.info/?l=bugtraq&m=144182594518755&w=2
http://rhn.redhat.com/errata/RHSA-2014-2025.html
http://rhn.redhat.com/errata/RHSA-2015-0104.html
http://secunia.com/advisories/62209
http://support.ntp.org/bin/view/Main/SecurityNotice Vendor Advisory
http://www.kb.cert.org/vuls/id/852879 Third Party Advisory US Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2015:003
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
http://www.securityfocus.com/bid/71761
http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417665.htm
https://bugzilla.redhat.com/show_bug.cgi?id=1176037
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04790232
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04916783
https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes
https://kc.mcafee.com/corporate/index?page=content&id=SB10103
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20141222-ntpd
https://www.arista.com/en/support/advisories-notices/security-advisories/1047-security-advisory-8
cvelogic Threat Intelligence