K15934 : NTP vulnerability CVE-2014-9293

Security Advisory Description

The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
(
CVE-2014-9293
)
Impact
Default NTP configurations composed through the Configuration utility or the Traffic Management Shell (tmsh) are not vulnerable becauseauthor** keyvalues are omitted on the BIG-IP system.
However, if the NTP configuration has been manually customized by modifying NTP configuration files to include the vulnerable values, such as auth,key, orautokey** options, and there are no configured keys, the NTP daemon is vulnerable. A remote attacker may then be able to access private mode and control mode queries that require authentication. However, exploitation of this vulnerability is considered highly unlikely because the attacker would also need prior knowledge of the NTP destination and be able to guess the key. Additionally, this configuration would likely not work since matching keys are a requirement for NTP** auth** to work.