CVEvulnerability
CVE-2015-7974
7.7 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-01-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-287
Description
NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
Affected configurations
• ntp ntp (>= 4.2.0 < 4.2.8)
• ntp ntp (>= 4.3.0 < 4.3.90)
• ntp ntp 4.2.8
• siemens tim 4r-ie firmware
• siemens tim 4r-ie dnp3 firmware
• netapp clustered data ontap
• netapp oncommand balance
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://bugs.ntp.org/show_bug.cgi?id=2936 Issue Tracking, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2583.html Third Party Advisory
- http://support.ntp.org/bin/view/Main/NtpBug2936 Vendor Advisory
- http://www.debian.org/security/2016/dsa-3629 Third Party Advisory
- http://www.securityfocus.com/bid/81960 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034782 Third Party Advisory, VDB Entry
- http://www.talosintel.com/reports/TALOS-2016-0071/ Exploit, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf Third Party Advisory
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03750en_us Third Party Advisory
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03766en_us Third Party Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc Third Party Advisory
- https://security.gentoo.org/glsa/201607-15 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20171031-0001/ Third Party Advisory
- https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11 Third Party Advisory, US Government Resource
- http://bugs.ntp.org/show_bug.cgi?id=2936 Issue Tracking, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2583.html Third Party Advisory
- http://support.ntp.org/bin/view/Main/NtpBug2936 Vendor Advisory
- http://www.debian.org/security/2016/dsa-3629 Third Party Advisory
- http://www.securityfocus.com/bid/81960 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034782 Third Party Advisory, VDB Entry
- http://www.talosintel.com/reports/TALOS-2016-0071/ Exploit, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf Third Party Advisory
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03750en_us Third Party Advisory
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03766en_us Third Party Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc Third Party Advisory
- https://security.gentoo.org/glsa/201607-15 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20171031-0001/ Third Party Advisory
- https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11 Third Party Advisory, US Government Resource