CVEvulnerability
CVE-2015-3405
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-08-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-331
Description
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
Affected configurations
• ntp ntp 4.2.8
• ntp ntp 4.3.0
• ntp ntp 4.3.1
• ntp ntp 4.3.2
• ntp ntp 4.3.3
• ntp ntp 4.3.4
• ntp ntp 4.3.5
• ntp ntp 4.3.6
• ntp ntp 4.3.7
• ntp ntp 4.3.8
• ntp ntp 4.3.9
• ntp ntp 4.3.10
• ntp ntp 4.3.11
• debian debian linux 7.0
• debian debian linux 8.0
• opensuse suse linux enterprise server 11.0
• opensuse project suse linux enterprise desktop 11.0
• suse suse linux enterprise server 11.0
• fedoraproject fedora 21
• redhat enterprise linux desktop 6.0
• redhat enterprise linux for ibm z systems 6.0
• redhat enterprise linux for power big endian 6.0
• redhat enterprise linux for scientific computing 6.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server from rhui 6 6.0
• redhat enterprise linux workstation 6.0
Related
Weakness · CWE (1)
- CWE-331 Insufficient Entropy weakness
References
- http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg Third Party Advisory, Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156248.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00000.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1459.html Third Party Advisory, VDB Entry
- http://rhn.redhat.com/errata/RHSA-2015-2231.html Third Party Advisory, VDB Entry
- http://www.debian.org/security/2015/dsa-3223 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3388 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/04/23/14 Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html www.oracle.com
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html www.oracle.com
- http://www.securityfocus.com/bid/74045 Third Party Advisory, VDB Entry
- https://bugs.ntp.org/show_bug.cgi?id=2797 Issue Tracking, Third Party Advisory, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1210324 Issue Tracking, Patch, Third Party Advisory, VDB Entry
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us support.hpe.com
- http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg Third Party Advisory, Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156248.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00000.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1459.html Third Party Advisory, VDB Entry
- http://rhn.redhat.com/errata/RHSA-2015-2231.html Third Party Advisory, VDB Entry
- http://www.debian.org/security/2015/dsa-3223 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3388 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/04/23/14 Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html www.oracle.com
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html www.oracle.com
- http://www.securityfocus.com/bid/74045 Third Party Advisory, VDB Entry
- https://bugs.ntp.org/show_bug.cgi?id=2797 Issue Tracking, Third Party Advisory, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1210324 Issue Tracking, Patch, Third Party Advisory, VDB Entry
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us support.hpe.com