Auth bypass in Netapp Clustered_data_ontap
CVE-2015-7974
NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton…
Vulnerability class: Broken Authentication
EPSS: 0.107 (93.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N.
Affected products
- Netapp Clustered_data_ontap
- Netapp Oncommand_balance
- Ntp — versions 4.2.8
- Siemens Tim_4r-ie
- Siemens Tim_4r-ie_dnp3
- Siemens Tim_4r-ie_dnp3_firmware
- Siemens Tim_4r-ie_firmware
- Debian Debian_linux — versions 8.0, 9.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- DSA-3629 (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- 81960 (Third Party Advisory, VDB Entry, vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- 1034782 (Third Party Advisory, VDB Entry, vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
- RHSA-2016:2583 (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2015-7974?
- CVE-2015-7974 is a high-severity vulnerability in Netapp Clustered_data_ontap, classified under Improper Authentication. CVSS score: 7.7/10. Published 2016-01-26.
- How severe is CVE-2015-7974?
- High severity. CVSS v3 base score is 7.7 out of 10.