CVE-2015-5146: Input Validation
First published: Wed Jul 01 2015(Updated: )
A flaw was found in the way ntpd processed certain remote configuration packets. An attacker could use a specially crafted package to cause ntpd to crash if: * ntpd enabled remote configuration * The attacker had the knowledge of the configuration password * The attacker had access to a computer entrusted to perform remote configuration Note that remote configuration is disabled by default in NTP. External References: <a href="http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi">http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fedoraproject Fedora | =21 | |
| Fedoraproject Fedora | =22 | |
| Fedoraproject Fedora | =23 | |
| Debian Debian Linux | =7.0 | |
| Debian Debian Linux | =8.0 | |
| NTP ntp | <=4.2.8 | |
| redhat/ntp | <4.2.8 | 4.2.8 |
| redhat/ntp | <4.3.25 | 4.3.25 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugs.ntp.org/show_bug.cgi?id=2853
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166992.html
- http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu
- http://www.debian.org/security/2015/dsa-3388
- http://www.securityfocus.com/bid/75589
- http://www.securitytracker.com/id/1034168
- https://bugzilla.redhat.com/show_bug.cgi?id=1238136
- https://security.gentoo.org/glsa/201509-01
- https://security.netapp.com/advisory/ntap-20180731-0003/
- http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1238140
- https://bodhi.fedoraproject.org/updates/FEDORA-2015-14211
- https://bodhi.fedoraproject.org/updates/FEDORA-2015-14212
- https://bodhi.fedoraproject.org/updates/FEDORA-2015-14213
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-5146
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/tags
- agent/event
- agent/trending
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/21
- version/fedoraproject fedora/22
- version/fedoraproject fedora/23
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/7.0
- version/debian debian linux/8.0
- vendor/ntp
- canonical/ntp ntp
- version/ntp ntp/4.2.8
- package-manager/redhat