PT-2015-6781 · Nts+2 · Ntp+2

Martin Prpič · Publicado 2015-07-02 · Atualizado 2018-08-02 · CVE-2015-5146

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ntp versions prior to 4.2.8p3

Description The issue allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.

Recommendations For versions prior to 4.2.8p3, update to version 4.2.8p3 or later to resolve the issue. As a temporary workaround, consider restricting access to remote configuration to minimize the risk of exploitation.

Exploit

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2017-2335

CVE-2015-5146

DLA-335-1

DSA-3388-1

MGASA-2015-0348

USN-2783-1

Produtos afetados

Alt Linux

Ubuntu

Ntp

Referências · 122

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2016-7434 · Exploit
• https://cve.org/CVERecord?id=CVE-2015-5146 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-02017 · Nota de Segurança
• https://exploit-db.com/exploits/40840 · Nota
• http://securityfocus.com/bid/75589 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2516 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5194 · Nota de Segurança
• https://security-tracker.debian.org/tracker/source-package/ntp · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9310 · Nota de Segurança
• https://packages.debian.org/src:ntp · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7975 · Nota de Segurança
• http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5146 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5219 · Nota de Segurança