PT-2016-3842 · Ntf+7 · Ntp+10

Matt Street

·

Publicado

2016-01-26

·

Atualizado

2024-06-15

·

CVE-2015-7974

CVSS v3.1

7.7

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions NTP versions 4.x before 4.2.8p6 NTP versions 4.3.x before 4.3.90
Description The issue allows remote attackers to conduct impersonation attacks via an arbitrary trusted key, also known as a "skeleton key", because peer associations of symmetric keys are not verified when authenticating packets.
Recommendations For NTP versions 4.x before 4.2.8p6, update to version 4.2.8p6 or later. For NTP versions 4.3.x before 4.3.90, update to version 4.3.90 or later.

Exploit

Correção

DoS

Improper Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

ALT-PU-2017-2335
CESA-2016_2583
CVE-2015-7974
DLA-559-1
DSA-3629-1
MGASA-2016-0039
OPENSUSE-SU-2016_1292-1
OPENSUSE-SU-2016_1329-1
OPENSUSE-SU-2024:10181-1
RHSA-2016:2583
RHSA-2016_2583
SUSE-SU-2016:1175-1
SUSE-SU-2016:1177-1
SUSE-SU-2016:1247-1
SUSE-SU-2016:1278-1
SUSE-SU-2016:1291-1
SUSE-SU-2016:1311-1
SUSE-SU-2016:1471-1
SUSE-SU-2016:1568-1
USN-3096-1

Produtos afetados

Alt Linux
Centos
Cisco Ios
Cisco Ios Xe
Cisco Ios Xr
Cisco Nexus
Freebsd
Ntp
Red Hat
Suse
Ubuntu