// For flags

CVE-2015-5300

ntp: MITM attacker can force ntpd to make a step larger than the panic threshold

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

La comprobación panic_gate en NTP anterior a versión 4.2.8p5 es solo habilitada nuevamente después del primer cambio al reloj del sistema que fue mayor que 128 milisegundos por defecto, permitiendo a los atacantes remotos fijar el NTP a un tiempo arbitrario cuando arranca con la opción -g, o alterar el tiempo hasta 900 segundos, de lo contrario por respuesta a un número no especificado de peticiones de fuentes de confianza y aprovechando una denegación de servicio resultante (anular y reiniciar).

It was found that ntpd did not correctly implement the threshold limitation for the '-g' option, which is used to set the time without any restrictions. A man-in-the-middle attacker able to intercept NTP traffic between a connecting client and an NTP server could use this flaw to force that client to make multiple steps larger than the panic threshold, effectively changing the time to an arbitrary value at any time.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2015-07-01 CVE Reserved
  • 2015-10-27 CVE Published
  • 2024-08-06 CVE Updated
  • 2024-10-21 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
  • CWE-361: 7PK - Time and State
CAPEC
References (40)
URL Tag Source
http://aix.software.ibm.com/aix/efixes/security/ntp_advisory5.asc Third Party Advisory
http://seclists.org/bugtraq/2016/Feb/164 Mailing List
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Third Party Advisory
http://www.securityfocus.com/bid/77312 Third Party Advisory
http://www.securitytracker.com/id/1034670 Third Party Advisory
https://bto.bluecoat.com/security-advisory/sa113 Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-356-01 Third Party Advisory
https://security.netapp.com/advisory/ntap-20171004-0001 X_refsource_confirm
https://support.citrix.com/article/CTX220112 Third Party Advisory
https://www-01.ibm.com/support/docview.wss?uid=isg3T1023885 Third Party Advisory
https://www-01.ibm.com/support/docview.wss?uid=isg3T1024073 Third Party Advisory
https://www-01.ibm.com/support/docview.wss?uid=nas8N1021264 Third Party Advisory
https://www-01.ibm.com/support/docview.wss?uid=ssg1S1005821 Third Party Advisory
https://www-01.ibm.com/support/docview.wss?uid=swg21979393 Third Party Advisory
https://www-01.ibm.com/support/docview.wss?uid=swg21980676 Third Party Advisory
https://www-01.ibm.com/support/docview.wss?uid=swg21983501 Third Party Advisory
https://www-01.ibm.com/support/docview.wss?uid=swg21983506 Third Party Advisory
https://www.cs.bu.edu/~goldbe/NTPattack.html Third Party Advisory
https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099428 Third Party Advisory
https://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html Third Party Advisory
https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html Third Party Advisory
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
21
Search vendor "Fedoraproject" for product "Fedora" and version "21"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
22
Search vendor "Fedoraproject" for product "Fedora" and version "22"
-
Affected
Suse
Search vendor "Suse"
Linux Enterprise Debuginfo
Search vendor "Suse" for product "Linux Enterprise Debuginfo"
11
Search vendor "Suse" for product "Linux Enterprise Debuginfo" and version "11"
sp2
Affected
Suse
Search vendor "Suse"
Linux Enterprise Debuginfo
Search vendor "Suse" for product "Linux Enterprise Debuginfo"
11
Search vendor "Suse" for product "Linux Enterprise Debuginfo" and version "11"
sp3
Affected
Suse
Search vendor "Suse"
Linux Enterprise Debuginfo
Search vendor "Suse" for product "Linux Enterprise Debuginfo"
11
Search vendor "Suse" for product "Linux Enterprise Debuginfo" and version "11"
sp4
Affected
Opensuse
Search vendor "Opensuse"
Leap
Search vendor "Opensuse" for product "Leap"
42.1
Search vendor "Opensuse" for product "Leap" and version "42.1"
-
Affected
Opensuse
Search vendor "Opensuse"
Opensuse
Search vendor "Opensuse" for product "Opensuse"
13.2
Search vendor "Opensuse" for product "Opensuse" and version "13.2"
-
Affected
Suse
Search vendor "Suse"
Linux Enterprise Desktop
Search vendor "Suse" for product "Linux Enterprise Desktop"
12
Search vendor "Suse" for product "Linux Enterprise Desktop" and version "12"
-
Affected
Suse
Search vendor "Suse"
Linux Enterprise Desktop
Search vendor "Suse" for product "Linux Enterprise Desktop"
12
Search vendor "Suse" for product "Linux Enterprise Desktop" and version "12"
sp1
Affected
Suse
Search vendor "Suse"
Linux Enterprise Server
Search vendor "Suse" for product "Linux Enterprise Server"
10
Search vendor "Suse" for product "Linux Enterprise Server" and version "10"
sp4, ltss
Affected
Suse
Search vendor "Suse"
Linux Enterprise Server
Search vendor "Suse" for product "Linux Enterprise Server"
11
Search vendor "Suse" for product "Linux Enterprise Server" and version "11"
sp2, ltss
Affected
Suse
Search vendor "Suse"
Linux Enterprise Server
Search vendor "Suse" for product "Linux Enterprise Server"
11
Search vendor "Suse" for product "Linux Enterprise Server" and version "11"
sp3, ltss
Affected
Suse
Search vendor "Suse"
Linux Enterprise Server
Search vendor "Suse" for product "Linux Enterprise Server"
11
Search vendor "Suse" for product "Linux Enterprise Server" and version "11"
sp4
Affected
Suse
Search vendor "Suse"
Linux Enterprise Server
Search vendor "Suse" for product "Linux Enterprise Server"
12
Search vendor "Suse" for product "Linux Enterprise Server" and version "12"
sp1
Affected
Suse
Search vendor "Suse"
Linux Enterprise Software Development Kit
Search vendor "Suse" for product "Linux Enterprise Software Development Kit"
12
Search vendor "Suse" for product "Linux Enterprise Software Development Kit" and version "12"
-
Affected
Suse
Search vendor "Suse"
Linux Enterprise Software Development Kit
Search vendor "Suse" for product "Linux Enterprise Software Development Kit"
12
Search vendor "Suse" for product "Linux Enterprise Software Development Kit" and version "12"
sp1
Affected
Suse
Search vendor "Suse"
Manager
Search vendor "Suse" for product "Manager"
2.1
Search vendor "Suse" for product "Manager" and version "2.1"
-
Affected
Suse
Search vendor "Suse"
Manager Proxy
Search vendor "Suse" for product "Manager Proxy"
2.1
Search vendor "Suse" for product "Manager Proxy" and version "2.1"
-
Affected
Suse
Search vendor "Suse"
Openstack Cloud
Search vendor "Suse" for product "Openstack Cloud"
5
Search vendor "Suse" for product "Openstack Cloud" and version "5"
-
Affected
Suse
Search vendor "Suse"
Suse Linux Enterprise Server
Search vendor "Suse" for product "Suse Linux Enterprise Server"
12
Search vendor "Suse" for product "Suse Linux Enterprise Server" and version "12"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Desktop
Search vendor "Redhat" for product "Enterprise Linux Desktop"
6.0
Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "6.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Desktop
Search vendor "Redhat" for product "Enterprise Linux Desktop"
7.0
Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "7.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Hpc Node
Search vendor "Redhat" for product "Enterprise Linux Hpc Node"
6.0
Search vendor "Redhat" for product "Enterprise Linux Hpc Node" and version "6.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Hpc Node
Search vendor "Redhat" for product "Enterprise Linux Hpc Node"
7.0
Search vendor "Redhat" for product "Enterprise Linux Hpc Node" and version "7.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Hpc Node Eus
Search vendor "Redhat" for product "Enterprise Linux Hpc Node Eus"
7.1
Search vendor "Redhat" for product "Enterprise Linux Hpc Node Eus" and version "7.1"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Server
Search vendor "Redhat" for product "Enterprise Linux Server"
6.0
Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Server
Search vendor "Redhat" for product "Enterprise Linux Server"
7.0
Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Server Eus
Search vendor "Redhat" for product "Enterprise Linux Server Eus"
6.7.z
Search vendor "Redhat" for product "Enterprise Linux Server Eus" and version "6.7.z"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Server Eus
Search vendor "Redhat" for product "Enterprise Linux Server Eus"
7.1
Search vendor "Redhat" for product "Enterprise Linux Server Eus" and version "7.1"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Workstation
Search vendor "Redhat" for product "Enterprise Linux Workstation"
6.0
Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "6.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Workstation
Search vendor "Redhat" for product "Enterprise Linux Workstation"
7.0
Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "7.0"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
7.0
Search vendor "Debian" for product "Debian Linux" and version "7.0"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
8.0
Search vendor "Debian" for product "Debian Linux" and version "8.0"
-
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
12.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04"
lts
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
14.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04"
lts
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
15.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "15.04"
-
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
15.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "15.10"
-
Affected
Ntp
Search vendor "Ntp"
Ntp
Search vendor "Ntp" for product "Ntp"
<= 4.2.8
Search vendor "Ntp" for product "Ntp" and version " <= 4.2.8"
p4
Affected