CVE-2015-5194
published 2017-07-21CVE-2015-5194: The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted…
PriorityP341high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
6.48%
93.7th percentile
The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | ntp | < ntp 1:4.2.8p3+dfsg-1 (bullseye) | ntp 1:4.2.8p3+dfsg-1 (bullseye) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| ntp | ntp | <= 4.2.7 | — |
| ntp | ntp | >= 0 < 1:4.2.8p3+dfsg-1 | 1:4.2.8p3+dfsg-1 |
| ntp | ntp | >= 0 < 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5 | 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_hpc_node | — | — |
| redhat | enterprise_linux_hpc_node | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise_debuginfo | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| suse | manager | — | — |
| suse | manager_proxy | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3263-mvg8-28x9: The log_config_command function in ntp_parser
ghsa_unreviewed·2022-05-14
CVE-2015-5194 [HIGH] CWE-20 GHSA-3263-mvg8-28x9: The log_config_command function in ntp_parser
The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
OSV
CVE-2015-5194: The log_config_command function in ntp_parser
osv·2017-07-21·CVSS 7.5
CVE-2015-5194 [HIGH] CVE-2015-5194: The log_config_command function in ntp_parser
The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
OSV
ntp vulnerabilities
osv·2015-10-27·CVSS 5.3
CVE-2015-5146 [MEDIUM] ntp vulnerabilities
ntp vulnerabilities
Aleksis Kauppinen discovered that NTP incorrectly handled certain remote
config packets. In a non-default configuration, a remote authenticated
attacker could possibly use this issue to cause NTP to crash, resulting in
a denial of service. (CVE-2015-5146)
Miroslav Lichvar discovered that NTP incorrectly handled logconfig
directives. In a non-default configuration, a remote authenticated attacker
could possibly use this issue to cause NTP to crash, resulting in a denial
of service. (CVE-2015-5194)
Miroslav Lichvar discovered that NTP incorrectly handled certain statistics
types. In a non-default configuration, a remote authenticated attacker
could possibly use this issue to cause NTP to crash, resulting in a denial
of service. (CVE-2015-5195)
Miroslav Lichvar discove
Ubuntu
NTP vulnerabilities
vendor_ubuntu·2015-10-27·CVSS 5.3
CVE-2015-5146 [MEDIUM] NTP vulnerabilities
Title: NTP vulnerabilities
Summary: Several security issues were fixed in NTP.
Aleksis Kauppinen discovered that NTP incorrectly handled certain remote
config packets. In a non-default configuration, a remote authenticated
attacker could possibly use this issue to cause NTP to crash, resulting in
a denial of service. (CVE-2015-5146)
Miroslav Lichvar discovered that NTP incorrectly handled logconfig
directives. In a non-default configuration, a remote authenticated attacker
could possibly use this issue to cause NTP to crash, resulting in a denial
of service. (CVE-2015-5194)
Miroslav Lichvar discovered that NTP incorrectly handled certain statistics
types. In a non-default configuration, a remote authenticated attacker
could possibly use this issue to cause NTP to crash, resulting in a
Red Hat
ntp: crash with crafted logconfig configuration command
vendor_redhat·2015-08-25·CVSS 7.5
CVE-2015-5194 [HIGH] CWE-665 ntp: crash with crafted logconfig configuration command
ntp: crash with crafted logconfig configuration command
The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.
Package: ntp (Red Hat Enterprise Linux 5) - Will not fix
Debian
CVE-2015-5194: ntp - The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 a...
vendor_debian·2015·CVSS 7.5
CVE-2015-5194 [HIGH] CVE-2015-5194: ntp - The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 a...
The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
Scope: local
bullseye: resolved (fixed in 1:4.2.8p3+dfsg-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-5194 ntp: invalid free() with crafted logconfig configuration command [fedora-all]
bugzilla·2015-08-25·CVSS 7.5
CVE-2015-5194 [HIGH] CVE-2015-5194 ntp: invalid free() with crafted logconfig configuration command [fedora-all]
CVE-2015-5194 ntp: invalid free() with crafted logconfig configuration command [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supporte
Bugzilla
CVE-2015-5194 ntp: crash with crafted logconfig configuration command
bugzilla·2015-08-18·CVSS 7.5
CVE-2015-5194 [HIGH] CVE-2015-5194 ntp: crash with crafted logconfig configuration command
CVE-2015-5194 ntp: crash with crafted logconfig configuration command
It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands, for example:
ntpq -c ":config logconfig a"
Upstream patch:
http://bk.ntp.org/ntp-dev/?PAGE=patch&REV=4c4fc141LwvcoGp-lLGhkAFp3ZvtrA
Discussion:
Created ntp tracking bugs for this issue:
Affects: fedora-all [bug 1256681]
---
ntp-4.2.6p5-33.fc21 has been submitted as an update to Fedora 21. https://bodhi.fedoraproject.org/updates/FEDORA-2015-14211
---
ntp-4.2.6p5-33.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-14212
---
ntp-4.2.6p5-33.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FED
http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=4c4fc141LwvcoGp-lLGhkAFp3ZvtrAhttp://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0780.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2583.htmlhttp://www.debian.org/security/2015/dsa-3388http://www.openwall.com/lists/oss-security/2015/08/25/3http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/76475http://www.ubuntu.com/usn/USN-2783-1https://bugzilla.redhat.com/show_bug.cgi?id=1254542https://github.com/ntp-project/ntp/commit/553f2fa65865c31c5e3c48812cfd46176cffdd27https://www-01.ibm.com/support/docview.wss?uid=isg3T1024157https://www-01.ibm.com/support/docview.wss?uid=swg21985122https://www-01.ibm.com/support/docview.wss?uid=swg21986956https://www-01.ibm.com/support/docview.wss?uid=swg21988706https://www-01.ibm.com/support/docview.wss?uid=swg21989542http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=4c4fc141LwvcoGp-lLGhkAFp3ZvtrAhttp://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0780.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2583.htmlhttp://www.debian.org/security/2015/dsa-3388http://www.openwall.com/lists/oss-security/2015/08/25/3http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/76475http://www.ubuntu.com/usn/USN-2783-1https://bugzilla.redhat.com/show_bug.cgi?id=1254542https://github.com/ntp-project/ntp/commit/553f2fa65865c31c5e3c48812cfd46176cffdd27https://www-01.ibm.com/support/docview.wss?uid=isg3T1024157https://www-01.ibm.com/support/docview.wss?uid=swg21985122https://www-01.ibm.com/support/docview.wss?uid=swg21986956https://www-01.ibm.com/support/docview.wss?uid=swg21988706https://www-01.ibm.com/support/docview.wss?uid=swg21989542
2017-07-21
Published