CVE Vulnerabilities

CVE-2015-7974

Improper Authentication

Published: Jan 26, 2016 | Modified: Apr 26, 2021
CVSS 3.x
7.7
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:N/I:P/A:N
RedHat/V2
3.6 LOW
AV:N/AC:H/Au:S/C:N/I:P/A:P
RedHat/V3
Ubuntu
LOW

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a skeleton key.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Ntp Ntp 4.2.0 (including) 4.2.8 (excluding)
Ntp Ntp 4.3.0 (including) 4.3.90 (excluding)
Ntp Ntp 4.2.8 (including) 4.2.8 (including)
Ntp Ntp 4.2.8-p1 (including) 4.2.8-p1 (including)
Ntp Ntp 4.2.8-p1-beta1 (including) 4.2.8-p1-beta1 (including)
Ntp Ntp 4.2.8-p1-beta2 (including) 4.2.8-p1-beta2 (including)
Ntp Ntp 4.2.8-p1-beta3 (including) 4.2.8-p1-beta3 (including)
Ntp Ntp 4.2.8-p1-beta4 (including) 4.2.8-p1-beta4 (including)
Ntp Ntp 4.2.8-p1-beta5 (including) 4.2.8-p1-beta5 (including)
Ntp Ntp 4.2.8-p1-rc1 (including) 4.2.8-p1-rc1 (including)
Ntp Ntp 4.2.8-p1-rc2 (including) 4.2.8-p1-rc2 (including)
Ntp Ntp 4.2.8-p2 (including) 4.2.8-p2 (including)
Ntp Ntp 4.2.8-p2-rc1 (including) 4.2.8-p2-rc1 (including)
Ntp Ntp 4.2.8-p2-rc2 (including) 4.2.8-p2-rc2 (including)
Ntp Ntp 4.2.8-p2-rc3 (including) 4.2.8-p2-rc3 (including)
Ntp Ntp 4.2.8-p3 (including) 4.2.8-p3 (including)
Ntp Ntp 4.2.8-p3-rc1 (including) 4.2.8-p3-rc1 (including)
Ntp Ntp 4.2.8-p3-rc2 (including) 4.2.8-p3-rc2 (including)
Ntp Ntp 4.2.8-p3-rc3 (including) 4.2.8-p3-rc3 (including)
Ntp Ntp 4.2.8-p4 (including) 4.2.8-p4 (including)
Ntp Ntp 4.2.8-p5 (including) 4.2.8-p5 (including)
Red Hat Enterprise Linux 7 RedHat ntp-0:4.2.6p5-25.el7 *
Ntp Ubuntu precise *
Ntp Ubuntu trusty *
Ntp Ubuntu upstream *
Ntp Ubuntu vivid *
Ntp Ubuntu vivid/stable-phone-overlay *
Ntp Ubuntu wily *
Ntp Ubuntu xenial *

Potential Mitigations

References