CVE-2015-7979: High severity Siemens TIM 4R-IE (incl. SIPLUS NET variants) vulnerability
It was found that when NTP is configured in broadcast mode, an off-path attacker could broadcast packets with bad authentication (wrong key, mismatched key, incorrect MAC, etc) to all clients. The clients, upon receiving the malformed packets, would break the association with the broadcast server. This could cause the time on affected clients to become out of sync over a longer period of time.
Upstream patch:
https://github.com/ntp-project/ntp/commit/fe46889f7baa75fc8e6c0fcde87706d396ce1461
Other sources
NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7979?
CVE-2015-7979 is classified as a medium severity vulnerability that allows an off-path attacker to disrupt NTP services.
How do I fix CVE-2015-7979?
To fix CVE-2015-7979, upgrade to NTP version 4.2.8p12 or higher.
Which versions of NTP are affected by CVE-2015-7979?
Affected versions include NTP versions prior to 4.2.8p12 and 4.3.0 to 4.3.79.
What does CVE-2015-7979 exploit?
CVE-2015-7979 exploits vulnerabilities in NTP's broadcast mode that allow attackers to send malformed packets.
Are there specific products impacted by CVE-2015-7979?
Yes, products like Siemens TIM 4R-IE and TIM 4R-IE DNP3 are impacted by CVE-2015-7979.