CVE-2015-7848

{"id": "CVE-2015-7848", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-01-06T21:59:00.243", "references": [{"url": "http://www.securityfocus.com/bid/77275", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1033951", "source": "cve@mitre.org"}, {"url": "http://www.talosintelligence.com/reports/TALOS-2015-0052/", "tags": ["Exploit", "Technical Description", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://security.gentoo.org/glsa/201607-15", "source": "cve@mitre.org"}, {"url": "https://security.netapp.com/advisory/ntap-20171004-0001/", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash."}, {"lang": "es", "value": "Puede ocurrir un desbordamiento de entero en NTP-dev.4.3.70 que conduce a una operaci\u00f3n de copia de memoria fuera de l\u00edmites cuando se procesa un paquete de modo privado especialmente manipulado. El paquete manipulado necesita tener el c\u00f3digo correcto de autenticaci\u00f3n de mensajes y un timestamp valido. Cuando es procesado por el daemon NTP, conduce a un bloqueo inmediato."}], "lastModified": "2017-11-10T02:29:04.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ntp:ntp-dev:4.3.70:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A4BAFC3-55CB-4F0E-8A22-BF0FDA9FB786"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}