PT-2015-7646 · Ntf+5 · Ntp+7

John D Birdwell

·

Publicado

2015-10-21

·

Atualizado

2024-06-15

·

CVE-2015-7855

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions NTP versions 4.2.x through 4.2.8p3 NTP versions 4.3.x through 4.3.76
Description The issue allows remote attackers to cause a denial of service via a 6 or mode 7 packet containing a long data value. This is due to the decodenetnum function in ntpd, which causes an assertion failure instead of returning FAIL on some invalid values.
Recommendations For NTP versions 4.2.x through 4.2.8p3, update to version 4.2.8p4 or later. For NTP versions 4.3.x through 4.3.76, update to version 4.3.77 or later. As a temporary workaround, consider restricting access to the decodenetnum function until a patch is available.

Exploit

Correção

DoS

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

ALT-PU-2017-2335
CVE-2015-7855
DLA-335-1
DSA-3388-1
MGASA-2015-0418
OPENSUSE-SU-2024:10181-1
SUSE-SU-2015:2058-1
SUSE-SU-2016:1247-1
SUSE-SU-2016:1311-1
USN-2783-1

Produtos afetados

Alt Linux
Cisco Ios
Cisco Ios Xe
Cisco Nexus
Ibm Aix
Ntp
Suse
Ubuntu