Vulnerability in NTP
CVE-2015-5300
The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.091 (95.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 95.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.091 · newest: 0.091 · change: 0.000
Affected products
- NTP
- Canonical Ubuntu Linux — versions 12.04, 14.04, 15.04
- Debian Linux — versions 7.0, 8.0
- Fedoraproject Fedora — versions 21, 22
- openSUSE Leap — versions 42.1
- openSUSE — versions 13.2
- Red Hat Enterprise Linux Desktop — versions 6.0, 7.0
- Red Hat Enterprise Linux Hpc Node — versions 6.0, 7.0
- Red Hat Enterprise Linux Hpc Node Eus — versions 7.1
- Red Hat Enterprise Linux Server — versions 6.0, 7.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- rhn.redhat.com/errata/RHSA-2015-1930.html (vendor-advisory, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html (vendor-advisory, Third Party Advisory)
- seclists.org/bugtraq/2016/Feb/164 (mailing-list, Mailing List, Third Party Advisory)
- lists.opensuse.org/opensuse-updates/2016-05/msg00114.html (vendor-advisory, Third Party Advisory)
- www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html (Third Party Advisory)
- www.ubuntu.com/usn/USN-2783-1 (vendor-advisory, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html (vendor-advisory, Third Party Advisory)
- ics-cert.us-cert.gov/advisories/ICSA-15-356-01 (US Government Resource, Third Party Advisory)
- www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html (Third Party Advisory)
- support.ntp.org/bin/view/Main/SecurityNotice (Patch, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2015-5300?
- CVE-2015-5300 is a high-severity vulnerability in NTP, classified under CWE-361. CVSS score: 7.5/10. Published 2017-07-21.
- How severe is CVE-2015-5300?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2015-5300 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.