CVE-2014-9750: ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attac...

Security readout for executives and security teams

This flaw affects older NTP 4.x ntpd deployments only when Autokey Authentication is enabled. A remote attacker could make the time daemon crash or expose data from process memory. Business impact is mainly loss of reliable time synchronization, with possible information exposure on systems still running vulnerable NTP builds. Exposure is likely limited to systems running NTP 4.x before 4.2.8p1 with Autokey Authentication enabled. Internet-facing or untrusted-network ntpd services increase concern. Modern systems using patched vendor packages or not using Autokey are less likely exposed. Treat this as a legacy infrastructure hygiene issue unless vulnerable Autokey-enabled ntpd is exposed. Prioritize internet-facing time servers and systems where time reliability affects authentication, logging, or operations. Mitigation focus: Upgrade NTP to 4.2.8p1 or a vendor-patched package.; Disable Autokey Authentication where it is not operationally required.; Restrict NTP service exposure to trusted networks where possible..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.