CVE-2014-5209

A flaw was discovered where an information disclosure is present in the Network Time Protocol (NTP) through the GET_RESTRICT control message, which can be sent with the reslist command of the ntpdc tool. An attacker can use this message to obtain sensitive information such as internal IP addresses and NTP’s configuration settings.

This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, 7 in their default configurations. Red Hat Enterprise Linux uses the restrict noquery option by default, which denies ntpdc queries. No proper fix is available for this issue upstream, apart from disabling these kind of queries by default or denying them through the restrict access control command specified in /etc/ntp.conf. Users are adviced to use noquery in their configurations and allow them only from a trusted set of network addresses.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If not already present, add noquery option to the restrict access control command specified in /etc/ntp.conf. Red Hat Enterprise Linux 7 is shipped by default with the following setting:

restrict default nomodify notrap nopeer noquery