NTP Vulnerability issue -- CVE-2014-5209

[krisvamcee]

Hi all,

Could somebody please advise how do I fix the below vulnerability issue as I couldn't find any solution for it. Is this vulnerability a concern?

Vulnerability Description

--------------------

An NTP control (mode 6) message with the UNSETTRAP (31) opcode with an unknown association identifier will cause NTP to respond with two packets -- one error response packet indicating that the association identifier was invalid followed by another non-er

CVE-IDs -- 2014-5209

The only config I have on the router for ntp is 

ntp peer x.x.x.x

Regards

Kris

[Marvin Rhoads]

NTP has been the source of numerous reported vulnerabilities over the years. The particular one you mentioned though doesn't appear to affect the most common Cisco software (such as IOS and ASA).

Do you have a specific reason to suspect it affects your equipment?

In general, you should run the Cisco-recommended release (as indicated on the downloads page for that product) that both supports your hardware and addresses any significant security vulnerabilities according to the product release notes.

[krisvamcee]

Thanks Marvin.

I got this from the vulnerability scan report, although the severity is low, just want to know if we can fix this.

Regards

Kris

[Marvin Rhoads]

Cisco is pretty good about owning up to vulnerabilities and releasing patches. That one just didn't show up in my search.

What device and software version is the scanner reporting against?

[krisvamcee]

Hi Marvin,

It's ISR4431/K9 and version is 03.16.04b.S.

Regards

Kris

[Marvin Rhoads]

There's nothing in the release notes for that version (or others in the releases after it) that mention that vulnerability. I suspect your scanner is reporting a false positive.

[krisvamcee]

Yeah maybe. I will wait until next report comes out.

[feiyang2]

Hi, Marvin

   I also hit this issue CVE-2014-5209 in customer field. But I can not find any information from Cisco security center https://tools.cisco.com/security/center/publicationListing.x. Do you know where I can find more information of CVE-2014-5209 then I can judge whether customer's devices were impacted.

Thanks

Fei yang

[Marvin Rhoads]

I could not find the CVE cited in any Cisco publicly published security advisory or bugID. However I did find the following two BugIDs that should be of use in determining whether your customer's equipment is affected by the underlying ntp mode 6 and mode 7 vulnerabilities: https://quickview.cloudapps.cisco.com/quickview/bug/CSCum44673 https://quickview.cloudapps.cisco.com/quickview/bug/CSCtd75033

[feiyang2]

Thanks, Marvin.

I will check it.

Fei Yang