// For flags

CVE-2014-125036

drybjed ansible-ntp main.yml amplification

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability, which was classified as problematic, has been found in drybjed ansible-ntp. Affected by this issue is some unknown functionality of the file meta/main.yml. The manipulation leads to insufficient control of network message volume. The attack can only be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as ed4ca2cf012677973c220cdba36b5c60bfa0260b. It is recommended to apply a patch to fix this issue. VDB-217190 is the identifier assigned to this vulnerability.

Se encontró una vulnerabilidad en drybjed ansible-ntp y se ha clasificado como problemática. Una función desconocida del archivo meta/main.yml es afectada por este problema. La manipulación conduce a un control insuficiente del volumen de mensajes de la red. El ataque sólo se puede realizar dentro de la red local. La complejidad de un ataque es bastante alta. Se sabe que la explotación es difícil. El parche se identifica como ed4ca2cf012677973c220cdba36b5c60bfa0260b. Se recomienda aplicar un parche para solucionar este problema. VDB-217190 es el identificador asignado a esta vulnerabilidad.

Eine problematische Schwachstelle wurde in drybjed ansible-ntp entdeckt. Davon betroffen ist unbekannter Code der Datei meta/main.yml. Mittels Manipulieren mit unbekannten Daten kann eine insufficient control of network message volume-Schwachstelle ausgenutzt werden. Der Angriff kann im lokalen Netzwerk erfolgen. Die Komplexität eines Angriffs ist eher hoch. Sie ist schwierig ausnutzbar. Der Patch wird als ed4ca2cf012677973c220cdba36b5c60bfa0260b bezeichnet. Als bestmögliche Massnahme wird Patching empfohlen.

*Credits: VulDB GitHub Commit Analyzer
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Adjacent
Attack Complexity
High
Authentication
Single
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-01-02 CVE Reserved
  • 2023-01-02 CVE Published
  • 2024-07-25 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-406: Insufficient Control of Network Message Volume (Network Amplification)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ansible-ntp Project
Search vendor "Ansible-ntp Project"
 Ansible-ntp
Search vendor "Ansible-ntp Project" for product "Ansible-ntp"
 < 2014-10-08
Search vendor "Ansible-ntp Project" for product "Ansible-ntp" and version " < 2014-10-08"
-
Affected