PT-2017-6668 · Nts+3 · Ntp+3

Martin Prpič · Published 2015-04-12 · Updated 2023-02-13 · CVE-2015-3405

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ntp versions 4.2.8px through 4.2.8p2-RC2 ntp versions 4.3.x through 4.3.12

Description The issue is related to the generation of MD5 keys with insufficient entropy on big endian machines under specific conditions. This might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack. The estimated number of possible keys is 93.

Recommendations For ntp versions 4.2.8px through 4.2.8p2-RC2, update to version 4.2.8p2-RC2 or later. For ntp versions 4.3.x through 4.3.12, update to version 4.3.12 or later.

Fix

Weakness Enumeration

CWE-331

Related Identifiers

CESA-2015_1459

CESA-2015_2231

CVE-2015-3405

DLA-192-1

DSA-3223-1

DSA-3388-1

RHSA-2015:1459

RHSA-2015:2231

RHSA-2015_1459

RHSA-2015_2231

SUSE-SU-2015:0259-1

SUSE-SU-2015:0259-3

SUSE-SU-2015:0865-1

SUSE-SU-2015:1173-1

USN-2567-1

Affected Products

Centos

Red Hat

Suse

Ntp

References · 89

• https://osv.dev/vulnerability/DSA-3223-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1799 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5194 · Security Note
• https://ubuntu.com/security/notices/USN-2567-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/ntp · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1798 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5146 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5219 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7855 · Security Note
• http://debian.org/security/2015/dsa-3388 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-2231.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9751 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3405 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-2231.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-3405 · Vendor Advisory