Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2015-3405
HistoryAug 09, 2017 - 4:29 p.m.

CVE-2015-3405

2017-08-0916:29:00
CWE-331
[email protected]
web.nvd.nist.gov
1

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.003

Percentile

69.4%

JSON

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

Affected configurations

NVD
Node
ntpntpMatch4.2.8p1
OR
ntpntpMatch4.2.8p2
OR
ntpntpMatch4.2.8p2-rc1
OR
ntpntpMatch4.3.0
OR
ntpntpMatch4.3.1
OR
ntpntpMatch4.3.2
OR
ntpntpMatch4.3.3
OR
ntpntpMatch4.3.4
OR
ntpntpMatch4.3.5
OR
ntpntpMatch4.3.6
OR
ntpntpMatch4.3.7
OR
ntpntpMatch4.3.8
OR
ntpntpMatch4.3.9
OR
ntpntpMatch4.3.10
OR
ntpntpMatch4.3.11
Node
debiandebian_linuxMatch7.0
OR
debiandebian_linuxMatch8.0
Node
opensusesuse_linux_enterprise_serverMatch11.0sp3
OR
opensuse_projectsuse_linux_enterprise_desktopMatch11.0sp3
OR
susesuse_linux_enterprise_serverMatch11.0sp3vmware
Node
fedoraprojectfedoraMatch21
Node
redhatenterprise_linux_desktopMatch6.0
OR
redhatenterprise_linux_for_ibm_z_systemsMatch6.0
OR
redhatenterprise_linux_for_power_big_endianMatch6.0
OR
redhatenterprise_linux_for_scientific_computingMatch6.0
OR
redhatenterprise_linux_serverMatch6.0
OR
redhatenterprise_linux_server_from_rhui_6Match6.0
OR
redhatenterprise_linux_workstationMatch6.0

Related

ubuntucve 1
prion 1
cvelist 1
cve 1
debiancve 1
openvas 13
f5 2
nessus 17
suse 1
ibm 8
osv 2
veracode 5
oraclelinux 2
amazon 1
centos 2
redhat 2
fedora 1
debian 1
ubuntucve
ubuntucve
CVE-2015-3405
2017-08-09 00:00:00
prion
prion
Design/Logic Flaw
2017-08-09 16:29:00
cvelist
cvelist
CVE-2015-3405
2017-08-09 16:00:00
cve
cve
CVE-2015-3405
2017-08-09 16:29:00
debiancve
debiancve
CVE-2015-3405
2017-08-09 16:29:00
openvas
openvas
NTPd < 4.2.8p2, 4.3.x < 4.3.12 Keygen Vulnerability
2021-07-07 00:00:00
SUSE: Security Advisory (SUSE-SU-2015:1173-1)
2021-06-09 00:00:00
SUSE: Security Advisory for ntp (SUSE-SU-2015:1173-1)
2015-10-13 00:00:00
f5
f5
SOL17254 - NTP-keygen vulnerability CVE-2015-3405
2015-09-10 00:00:00
K17254 : NTP-keygen vulnerability CVE-2015-3405
2015-09-10 00:00:00
nessus
nessus
SUSE SLED11 / SLES11 Security Update : ntp (SUSE-SU-2015:1173-1)
2015-07-06 00:00:00
Debian DSA-3223-1 : ntp - security update
2015-04-14 00:00:00
Fedora 21 : ntp-4.2.6p5-30.fc21 (2015-5830)
2015-04-29 00:00:00
suse
suse
Security update for ntp (important)
2015-07-02 17:05:24
ibm
ibm
Security Bulletin: Vulnerabilities in ntp affect Power Hardware Management Console (CVE-2015-1798 CVE-2015-1799 CVE-2015-3405)
2021-09-23 01:31:39
Security Bulletin: Vulnerabilities in NTP affect IBM Security Network Protection (CVE-2015-1798, CVE-2015-1799, and CVE-2015-3405)
2018-06-16 21:30:32
Security Bulletin: IBM Security Access Manager for Mobile is affected by multiple NTP vulnerabilities
2018-06-16 21:39:29
osv
osv
ntp - security update
2015-04-12 00:00:00
ntp - security update
2015-04-10 00:00:00
veracode
veracode
Man-in-the-Middle (MitM)
2019-05-02 05:41:08
Man-In-The-Middle (MitM)
2019-05-02 05:41:08
Improper Input Validation And Arbitary Code Injection
2019-05-02 05:41:07
oraclelinux
oraclelinux
ntp security, bug fix, and enhancement update
2015-07-28 00:00:00
ntp security, bug fix, and enhancement update
2015-11-23 00:00:00
amazon
amazon
Low: ntp
2015-09-02 12:00:00
centos
centos
ntp, ntpdate, sntp security update
2015-11-30 19:45:44
ntp, ntpdate security update
2015-07-26 14:13:05
redhat
redhat
(RHSA-2015:1459) Moderate: ntp security, bug fix, and enhancement update
2015-07-22 00:00:00
(RHSA-2015:2231) Moderate: ntp security, bug fix, and enhancement update
2015-11-19 14:42:12
fedora
fedora
[SECURITY] Fedora 21 Update: ntp-4.2.6p5-30.fc21
2015-04-28 13:01:04
debian
debian
[SECURITY] [DSA 3388-1] ntp security update
2015-11-01 22:20:55

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.003

Percentile

69.4%

JSON
Related for NVD:CVE-2015-3405
ubuntucve1prion1cvelist1cve1debiancve1openvas13f52nessus17suse1ibm8osv2veracode5oraclelinux2amazon1centos2redhat2fedora1debian1