PT-2015-7646 · Ntf+5 · Ntp+7
John D Birdwell
·
Publicado
2015-10-21
·
Atualizado
2024-06-15
·
CVE-2015-7855
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
NTP versions 4.2.x through 4.2.8p3
NTP versions 4.3.x through 4.3.76
Description
The issue allows remote attackers to cause a denial of service via a 6 or mode 7 packet containing a long data value. This is due to the decodenetnum function in ntpd, which causes an assertion failure instead of returning FAIL on some invalid values.
Recommendations
For NTP versions 4.2.x through 4.2.8p3, update to version 4.2.8p4 or later.
For NTP versions 4.3.x through 4.3.76, update to version 4.3.77 or later.
As a temporary workaround, consider restricting access to the decodenetnum function until a patch is available.
Exploit
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Cisco Ios
Cisco Ios Xe
Cisco Nexus
Ibm Aix
Ntp
Suse
Ubuntu