[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2015-1798Date: (C)2015-04-08   (M)2024-02-22


The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 1.8
Exploit Score: 3.2
Impact Score: 2.9
 
CVSS V2 Metrics:
Access Vector: ADJACENT_NETWORK
Access Complexity: HIGH
Authentication: NONE
Confidentiality: NONE
Integrity: PARTIAL
Availability: NONE
  
Reference:
SECTRACK-1032032
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-ntpd
http://tools.cisco.com/security/center/viewAlert.x?alertId=38276
BID-73951
APPLE-SA-2015-06-30-2
DSA-3223
FEDORA-2015-5761
FEDORA-2015-5874
GLSA-201509-01
MDVSA-2015:202
RHSA-2015:1459
SSRT102029
USN-2567-1
VU#374268
http://bugs.ntp.org/show_bug.cgi?id=2779
http://support.apple.com/kb/HT204942
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
https://kc.mcafee.com/corporate/index?page=content&id=SB10114
openSUSE-SU-2015:0775

CWE    1
CWE-17
OVAL    14
oval:org.secpod.oval:def:602036
oval:org.secpod.oval:def:204260
oval:org.secpod.oval:def:204271
oval:org.secpod.oval:def:702509
...

© SecPod Technologies