CVE-2014-9296
ntp: receive() missing return on error
Severity
LowRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · December 19, 2014
Updated · November 21, 2025
Description
A missing return statement in the receive() function could potentially allow a remote attacker to bypass NTP's authentication mechanism.
Statement
This issue did not affect the versions of ntpd as shipped with Red Hat Enterprise Linux 4 and 5. It has been addressed in Red Hat Enterprise Linux 6 and 7 via RHSA-2014:2024.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Remove or comment out all configuration directives beginning with the crypto keyword in your ntp.conf file.
CVSS / CWE
CVSS 2.0 · 5AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-390 · Detection of Error Condition Without Action