CVE-2015-3405: High severity ntp vulnerability
A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server.
If the lowest byte of the temp variable is outside of the printable characters range (between 0x20 and 0x7f), the ntp-keygen utility enters an infinite loop. However, if the temp variable is within the aforementioned range, the generated MD5 key will consist of 20 identical characters, meaning only 93 possible keys can be generated.
Upstream bug:
https://bugs.ntp.org/showbug.cgi?id=2797
Upstream patch:
http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg
CVE request:
http://seclists.org/oss-sec/2015/q2/85
Other sources
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3405?
CVE-2015-3405 is considered a medium severity vulnerability due to its potential for key guessing attacks.
How do I fix CVE-2015-3405?
To fix CVE-2015-3405, upgrade the NTP software to the latest version where the issue is resolved.
What systems are affected by CVE-2015-3405?
CVE-2015-3405 affects various versions of NTP, particularly those prior to 4.2.8-p3 and 4.3.10.
What vulnerabilities does CVE-2015-3405 address?
CVE-2015-3405 specifically addresses the weak generation of MD5 symmetric keys in NTP, particularly on big-endian systems.
Can CVE-2015-3405 be exploited remotely?
Yes, CVE-2015-3405 can potentially be exploited remotely by attackers to spoof NTP clients or servers.