CVE-2015-3405

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-3405
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg Third Party Advisory Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156248.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00000.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1459.html Third Party Advisory VDB Entry
http://rhn.redhat.com/errata/RHSA-2015-2231.html Third Party Advisory VDB Entry
http://www.debian.org/security/2015/dsa-3223 Third Party Advisory
http://www.debian.org/security/2015/dsa-3388 Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/04/23/14 Mailing List Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/74045 Third Party Advisory VDB Entry
https://bugs.ntp.org/show_bug.cgi?id=2797 Issue Tracking Third Party Advisory Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1210324 Issue Tracking Patch Third Party Advisory VDB Entry
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.1:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.2:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.3:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.4:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.5:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.6:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.7:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.8:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.9:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.10:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.11:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:opensuse:suse_linux_enterprise_server:11.0:sp3:*:*:*:*:*:*
cpe:2.3:o:opensuse_project:suse_linux_enterprise_desktop:11.0:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:suse_linux_enterprise_server:11.0:sp3:*:*:*:vmware:*:*

Configuration 4 (hide)

cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui_6:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
History

13 Feb 2023, 00:49

Type Values Removed Values Added
Summary A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server. ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:2231', 'name': 'https://access.redhat.com/errata/RHSA-2015:2231', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:1459', 'name': 'https://access.redhat.com/errata/RHSA-2015:1459', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-3405', 'name': 'https://access.redhat.com/security/cve/CVE-2015-3405', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 15:16

Type Values Removed Values Added
Summary ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys. A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server.
References
  • (MISC) https://access.redhat.com/errata/RHSA-2015:2231 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:1459 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-3405 -
Information

Published : 2017-08-09 16:29

Updated : 2023-12-10 12:15

NVD link : CVE-2015-3405

Mitre link : CVE-2015-3405

CVE.ORG link : CVE-2015-3405

JSON object : View

Products Affected

redhat

  • enterprise_linux_for_scientific_computing
  • enterprise_linux_workstation
  • enterprise_linux_desktop
  • enterprise_linux_server
  • enterprise_linux_server_from_rhui_6
  • enterprise_linux_for_ibm_z_systems
  • enterprise_linux_for_power_big_endian

opensuse_project

  • suse_linux_enterprise_desktop

fedoraproject

  • fedora

ntp

  • ntp

opensuse

  • suse_linux_enterprise_server

debian

  • debian_linux

suse

  • suse_linux_enterprise_server
CWE
CWE-331

Insufficient Entropy