NVD

Id
24037  
Name
CVE-2015-1798  
Description
The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC.  
Reject
 
CVSS Version
2  
CVSS Score
1.8  
Severity
Low  
CVSS Base Score
1.8  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
3.2  
CVSS Vector
(AV:A/AC:H/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-04-08  
Modified Date
2016-10-24  
Seq
2015-1798  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
127502 24037 CVE-2015-1798 http://bugs.ntp.org/show_bug.cgi?id=2779  View
127503 24037 CVE-2015-1798 APPLE-SA-2015-06-30-2  View
127504 24037 CVE-2015-1798 FEDORA-2015-5874  View
127505 24037 CVE-2015-1798 FEDORA-2015-5761  View
127506 24037 CVE-2015-1798 openSUSE-SU-2015:0775  View
127507 24037 CVE-2015-1798 SSRT102029  View
127508 24037 CVE-2015-1798 http://support.apple.com/kb/HT204942  View
127509 24037 CVE-2015-1798 http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities  View
127510 24037 CVE-2015-1798 20150408 Multiple Vulnerabilities in ntpd (April 2015) Affecting Cisco Products  View
127511 24037 CVE-2015-1798 20150408 Network Time Protocol Daemon MAC Checking Failure Authentication Bypass Vulnerability  View
127512 24037 CVE-2015-1798 DSA-3223  View
127513 24037 CVE-2015-1798 VU#374268  View
127514 24037 CVE-2015-1798 MDVSA-2015:202  View
127515 24037 CVE-2015-1798 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html  View
127516 24037 CVE-2015-1798 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html  View
127517 24037 CVE-2015-1798 73951  View
127518 24037 CVE-2015-1798 1032032  View
127519 24037 CVE-2015-1798 USN-2567-1  View
127520 24037 CVE-2015-1798 https://kc.mcafee.com/corporate/index?page=content&id=SB10114  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
6795 JVNDB-2015-002115 NTP の ntpd の ntp_proto.c 内の receive の symmetric-key 機能におけるパケットを偽装される脆弱性 NTP の ntpd の ntp_proto.c 内の receive の symmetric-key 機能は、MAC (メッセージ認証コード) フィールドがゼロ以外の長さを持つ場合のみ正しい MAC を要求するため、パケットを偽装される脆弱性が存在します。 CVE-2015-1798 79023 CVE-2015-1798 24037 1.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002115.html 2015-04-07 2015-07-14 View