CVE-2015-5146
ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash)…
Does this matter?
Lower severity and a low EPSS score (4.09%). Track it; it rarely justifies an emergency change on its own.
Description
ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.
- CVSS 3.0
- 5.3 MEDIUMCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 4.09% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- fedoraproject/fedora · debian/debian linux · ntp/ntp
- Source
- cve@mitre.org
References
- http://bugs.ntp.org/show_bug.cgi?id=2853Issue Tracking, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166992.htmlThird Party Advisory
- http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_SecuVendor Advisory
- http://www.debian.org/security/2015/dsa-3388Third Party Advisory
- http://www.securityfocus.com/bid/75589Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034168Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1238136Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/201509-01Mitigation, Third Party Advisory, VDB Entry
- https://security.netapp.com/advisory/ntap-20180731-0003/
- http://bugs.ntp.org/show_bug.cgi?id=2853Issue Tracking, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166992.htmlThird Party Advisory
- http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_SecuVendor Advisory
- http://www.debian.org/security/2015/dsa-3388Third Party Advisory
- http://www.securityfocus.com/bid/75589Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034168Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1238136Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/201509-01Mitigation, Third Party Advisory, VDB Entry
- https://security.netapp.com/advisory/ntap-20180731-0003/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.