CVE-2015-5219: Incorrect Type Cast
It was discovered that sntp program would hang in an infinite loop when a crafted NTP packet was received, related to the conversion of the precision value in the packet to double.
Other sources
The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5219?
CVE-2015-5219 is rated as a medium severity vulnerability due to its potential to cause denial of service by hanging in an infinite loop.
How do I fix CVE-2015-5219?
To mitigate CVE-2015-5219, update to the patched version of the NTP software that resolves the type conversion issue.
Which software is affected by CVE-2015-5219?
CVE-2015-5219 affects various versions of the SNTP program, including Siemens TIM 4R-IE and Fedora versions 21, 22, and 23.
Is there a workaround for CVE-2015-5219?
Currently, there is no known workaround for CVE-2015-5219 aside from applying the recommended patches.
What type of vulnerability is CVE-2015-5219?
CVE-2015-5219 is a denial of service vulnerability caused by improper handling of crafted NTP packets.