CVE-2015-1798

Loading...

General

Score:1.8/10.0
Severity:Low
Category:Implementation Error

Impact Metrics

Confidentiality:None
Integrity:Partial
Availability:None

Exploitability Metrics

Access Vector:Adjacent Network
Access Complexity:High
Authentication:None

Relative vulnerabilities

CVE-2013-1741, CVE-2014-8127, CVE-2014-8128, CVE-2014-8129, CVE-2014-8130, CVE-2014-8139, CVE-2014-8140, CVE-2014-8141, CVE-2014-9297, CVE-2014-9298, CVE-2014-9750, CVE-2014-9751, CVE-2015-0209, CVE-2015-0235, CVE-2015-0273, CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0293, CVE-2015-1157, CVE-2015-1799, CVE-2015-3405, CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3666, CVE-2015-3667, CVE-2015-3668, CVE-2015-3671, CVE-2015-3672, CVE-2015-3673, CVE-2015-3674, CVE-2015-3675, CVE-2015-3676, CVE-2015-3677, CVE-2015-3678, CVE-2015-3679, CVE-2015-3680, CVE-2015-3681, CVE-2015-3682, CVE-2015-3683, CVE-2015-3684, CVE-2015-3685, CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, CVE-2015-3689, CVE-2015-3690, CVE-2015-3691, CVE-2015-3692, CVE-2015-3693, CVE-2015-3694, CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, CVE-2015-3702, CVE-2015-3703, CVE-2015-3704, CVE-2015-3705, CVE-2015-3706, CVE-2015-3707, CVE-2015-3708, CVE-2015-3709, CVE-2015-3710, CVE-2015-3711, CVE-2015-3712, CVE-2015-3713, CVE-2015-3714, CVE-2015-3715, CVE-2015-3716, CVE-2015-3717, CVE-2015-3718, CVE-2015-3719, CVE-2015-3720, CVE-2015-3721, CVE-2015-4000, CVE-2015-5194, CVE-2015-5300, CVE-2015-7036, CVE-2015-7691, CVE-2015-7692, CVE-2015-7701, CVE-2015-7702, CVE-2015-7703, CVE-2015-7704, CVE-2015-7705, CVE-2015-7848, CVE-2015-7849, CVE-2015-7850, CVE-2015-7851, CVE-2015-7852, CVE-2015-7853, CVE-2015-7854, CVE-2015-7855, CVE-2015-7871, CVE-2015-7973, CVE-2015-7974, CVE-2015-7975, CVE-2015-7976, CVE-2015-7977, CVE-2015-7978, CVE-2015-7979, CVE-2015-8138, CVE-2015-8158, CVE-2016-1547, CVE-2016-1548, CVE-2016-1549, CVE-2016-1550, CVE-2016-1551, CVE-2016-2516, CVE-2016-2517, CVE-2016-2518, CVE-2016-2519, CVE-2016-4953, CVE-2016-4954, CVE-2016-4955, CVE-2016-4956, CVE-2016-4957

Published on 08/04/15 - Updated on 05/01/18

Description

The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC.

Category: Implementation Error

CWE-17 (Code)
Weaknesses in this category are typically introduced during code development, including specification, design, and implementation.

Security Notices

US National Vulnerability DatabaseCVE-2015-1798
Amazon Linux ALAS-2015-520
Agence Nationale de la Sécurité des Systèmes d'Information CERTFR-2015-AVI-148, CERTFR-2015-AVI-273
Apple HT204942
Arch Linux ASA-201504-8
CentOS CESA-2015:1459, CESA-2015:2231
Debian DSA-3223-1
Debian LTSDLA-192-1
Oracle Linux ELSA-2015-1459, ELSA-2015-2231
Redhat RHSA-2015:1459, RHSA-2015:2231
Renater 2015/VULN121
SUSE SUSE-SU-2015:0865, SUSE-SU-2016:1912
Ubuntu USN-2567-1

Exploits

No exploits available for this CVE in our database.

Relative technologies

VendorProduct
ntpntp

Share this vulnerability with:

Twitter Facebook LinkedIn Mail