CVE-2015-5146 ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configu...
MediumCVSS 5.3
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ntp(Debian:11) | < 1:4.2.8p3+dfsg-1 | 1:4.2.8p3+dfsg-1 |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| ntp | <= 4.2.8 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- bugs.ntp.org issue-tracking third-party-advisory
- FEDORA-2015-77bfbc1bcd third-party-advisory vendor-advisory
- FEDORA-2015-14212 third-party-advisory vendor-advisory
- FEDORA-2015-14213 third-party-advisory vendor-advisory
- support.ntp.org vendor-advisory
- DSA-3388 third-party-advisory vendor-advisory
- 75589 third-party-advisory vdb-entry
- 1034168 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- GLSA-201509-01 mitigation third-party-advisory vdb-entry vendor-advisory
- security.netapp.com