CVE-2015-3405
published 2017-08-09CVE-2015-3405: ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest…
PriorityP344high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
5.29%
92.5th percentile
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | ntp | < ntp 1:4.2.6.p5+dfsg-7 (bullseye) | ntp 1:4.2.6.p5+dfsg-7 (bullseye) |
| fedoraproject | fedora | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | — | — |
| ntp | ntp | >= 0 < 1:4.2.6.p5+dfsg-7 | 1:4.2.6.p5+dfsg-7 |
| opensuse | suse_linux_enterprise_server | — | — |
| opensuse_project | suse_linux_enterprise_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_power_big_endian | — | — |
| redhat | enterprise_linux_for_scientific_computing | — | — |
| redhat | enterprise_linux_server | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ntp: ntp-keygen may generate non-random symmetric keys on big-endian systems
vendor_redhat·2015-04-09·CVSS 7.5
CVE-2015-3405 [HIGH] CWE-628 ntp: ntp-keygen may generate non-random symmetric keys on big-endian systems
ntp: ntp-keygen may generate non-random symmetric keys on big-endian systems
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server.
Statement: This issue affects the versions of ntp as shipped with Red Hat Enterprise Linux 5.
Red Hat Enterprise Linux 5 is now in P
Debian
CVE-2015-3405: ntp - ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not ge...
vendor_debian·2015·CVSS 7.5
CVE-2015-3405 [HIGH] CVE-2015-3405: ntp - ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not ge...
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
Scope: local
bullseye: resolved (fixed in 1:4.2.6.p5+dfsg-7)
GHSA
GHSA-wwx9-mwhp-g8mc: ntp-keygen in ntp 4
ghsa_unreviewed·2022-05-13
CVE-2015-3405 [HIGH] CWE-331 GHSA-wwx9-mwhp-g8mc: ntp-keygen in ntp 4
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
OSV
CVE-2015-3405: ntp-keygen in ntp 4
osv·2017-08-09·CVSS 7.5
CVE-2015-3405 [HIGH] CVE-2015-3405: ntp-keygen in ntp 4
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
No detection rules found.
No public exploits indexed.
http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygghttp://lists.fedoraproject.org/pipermail/package-announce/2015-April/156248.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00000.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1459.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2231.htmlhttp://www.debian.org/security/2015/dsa-3223http://www.debian.org/security/2015/dsa-3388http://www.openwall.com/lists/oss-security/2015/04/23/14http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/74045https://bugs.ntp.org/show_bug.cgi?id=2797https://bugzilla.redhat.com/show_bug.cgi?id=1210324https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_ushttp://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygghttp://lists.fedoraproject.org/pipermail/package-announce/2015-April/156248.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00000.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1459.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2231.htmlhttp://www.debian.org/security/2015/dsa-3223http://www.debian.org/security/2015/dsa-3388http://www.openwall.com/lists/oss-security/2015/04/23/14http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/74045https://bugs.ntp.org/show_bug.cgi?id=2797https://bugzilla.redhat.com/show_bug.cgi?id=1210324https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us
2017-08-09
Published