CVE-2015-7850: Medium severity ntp vulnerability
ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file.
Other sources
The following flaw was found in ntpd:
An exploitable denial of service vulnerability exists in the remote configuration functionality of the Network Time Protocol. A specially crafted configuration file could cause an endless loop resulting in a denial of service. An attacker could provide a the malicious configuration file to trigger this vulnerability.
External References:
http://talosintel.com/reports/TALOS-2015-0055/ http://support.ntp.org/bin/view/Main/SecurityNotice#October2015NTPSecurityVulner
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7850?
CVE-2015-7850 is classified as a denial of service vulnerability that can cause infinite loops or crashes in the affected NTP versions.
How do I fix CVE-2015-7850?
To fix CVE-2015-7850, upgrade to NTP version 4.2.8p4 or later, or 4.3.77 or later.
What software is affected by CVE-2015-7850?
CVE-2015-7850 affects NTP versions 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77.
Can CVE-2015-7850 be exploited by unauthenticated users?
No, CVE-2015-7850 can only be exploited by remote authenticated users.
What types of systems are impacted by CVE-2015-7850?
CVE-2015-7850 impacts various systems using affected versions of the NTP daemon, such as those on Red Hat and Debian Linux.