It was found that ntpd did not check whether a Message Authentication Code (MAC) was present in a received packet when ntpd was configured to use symmetric cryptographic keys. A man-in-the-middle attacker could use this flaw to send crafted packets that would be accepted by a client or a peer without the attacker knowing the symmetric key.
Find out more about CVE-2015-1798 from the MITRE CVE dictionary dictionary and NIST NVD.
This issue did not affect the version of ntp as shipped with Red Hat Enterprise Linux 5
Base Score | 2.6 |
---|---|
Base Metrics | AV:N/AC:H/Au:N/C:N/I:P/A:N |
Access Vector | Network |
Access Complexity | High |
Authentication | None |
Confidentiality Impact | None |
Integrity Impact | Partial |
Availability Impact | None |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Platform | Errata | Release Date |
---|---|---|
Red Hat Enterprise Linux 7 (ntp) | RHSA-2015:2231 | 2015-11-19 |
Red Hat Enterprise Linux 6 (ntp) | RHSA-2015:1459 | 2015-07-21 |
Platform | Package | State |
---|---|---|
Red Hat Enterprise Linux 5 | ntp | Not affected |