Published: 21/07/2017 Updated: 13/02/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

ntp_openssl.m4 in ntpd in NTP prior to 4.2.7p112 allows remote malicious users to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.

Vulnerable Product	Search on Vulmon	Subscribe to Product
fedoraproject fedora 22
fedoraproject fedora 23
fedoraproject fedora 21
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux hpc node 6.0
redhat enterprise linux hpc node 7.0
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
debian debian linux 8.0
debian debian linux 7.0
canonical ubuntu linux 12.04
canonical ubuntu linux 15.10
canonical ubuntu linux 14.04
canonical ubuntu linux 15.04
ntp ntp

Synopsis Moderate: ntp security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for ntp is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score ...

Several security issues were fixed in NTP ...

Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs: CVE-2015-5146 A flaw was found in the way ntpd processed certain remote configuration packets An attacker could use a specially crafted package to cause ntpd to crash if: ntpd enabled remote configuration The attacker had the ...

As <a href="supportntporg/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi">discussed upstream</a>, a flaw was found in the way ntpd processed certain remote configuration packets Note that remote configuration is disabled by default in NTP (CVE-2015-5146) It was found that the :config command can be used to se ...

It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled during compilation (eg timingstats) was referenced by the statistics or filegen configuration command ...

CVE-2015-5195

CWE-20 https://www-01.ibm.com/support/docview.wss?uid=swg21989542 https://www-01.ibm.com/support/docview.wss?uid=swg21988706 https://www-01.ibm.com/support/docview.wss?uid=swg21986956 https://www-01.ibm.com/support/docview.wss?uid=swg21985122 https://www-01.ibm.com/support/docview.wss?uid=isg3T1024157 https://github.com/ntp-project/ntp/commit/52e977d79a0c4ace997e5c74af429844da2f27be https://bugzilla.redhat.com/show_bug.cgi?id=1254544 http://www.ubuntu.com/usn/USN-2783-1 http://www.securityfocus.com/bid/76474 http://www.openwall.com/lists/oss-security/2015/08/25/3 http://www.debian.org/security/2015/dsa-3388 http://rhn.redhat.com/errata/RHSA-2016-2583.html http://rhn.redhat.com/errata/RHSA-2016-0780.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166992.html http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html https://access.redhat.com/errata/RHSA-2016:2583 https://usn.ubuntu.com/2783-1/https://nvd.nist.gov

CVE-2015-5195

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect