CVE-2015-5195

CWE-20 — Improper Input ValidationCWE-476 — NULL Pointer Dereference10 documents8 sources
Severity
7.5HIGH
EPSS
7.9%
top 7.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
NTP NTPCanonical Ubuntu LinuxDebian Debian Linux+5 more
Timeline
PublishedJul 21
Latest updateMay 14

Description

ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶Debianntp< 1:4.2.8p3+dfsg-1
▶NVDntp/ntp4.2.7

Also affects: Debian Linux 7.0, 8.0, Fedora 21, 22, 23, Ubuntu Linux 12.04, 14.04, 15.04, 15.10

Patches

Patch: www.openwall.com ↗Patch: github.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-rr6m-2g2v-4vm5: ntp_openssl↗2022-05-14
▶
CVEList
CVE-2015-5195: ntp_openssl↗2017-07-21
▶
OSV
CVE-2015-5195: ntp_openssl↗2017-07-21
▶
OSV
ntp vulnerabilities↗2015-10-27
▶

📋Vendor Advisories

3
Ubuntu
NTP vulnerabilities↗2015-10-27
▶
Red Hat
ntp: ntpd crash when processing config commands with statistics type↗2015-08-25
▶
Debian
CVE-2015-5195: ntp - ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause ...↗2015
▶

💬Community

2
Bugzilla
CVE-2015-5195 ntp: ntpd crash when processing config commands with statistics type [fedora-all]↗2015-08-25
▶
Bugzilla
CVE-2015-5195 ntp: ntpd crash when processing config commands with statistics type↗2015-08-18
▶