Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2015-3405

Опубликовано: 09 авг. 2017
Источник: nvd
CVSS3: 7.5
CVSS2: 5
EPSS Низкий

Описание

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.1:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.2:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.3:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.4:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.5:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.6:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.7:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.8:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.9:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.10:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.3.11:*:*:*:*:*:*:*
Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Конфигурация 3

Одно из

cpe:2.3:o:opensuse:suse_linux_enterprise_server:11.0:sp3:*:*:*:*:*:*
cpe:2.3:o:opensuse_project:suse_linux_enterprise_desktop:11.0:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:suse_linux_enterprise_server:11.0:sp3:*:*:*:vmware:*:*
Конфигурация 4
cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
Конфигурация 5

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui_6:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

EPSS

Процентиль: 90%
0.06205
Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-331

Связанные уязвимости

ubuntu логотип

CVE-2015-3405

CVSS3: 7.5
ubuntu
больше 8 лет назад

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

redhat логотип

CVE-2015-3405

redhat
больше 10 лет назад

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

debian логотип

CVE-2015-3405

CVSS3: 7.5
debian
больше 8 лет назад

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 d ...

github логотип

GHSA-wwx9-mwhp-g8mc

CVSS3: 7.5
github
больше 3 лет назад

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

suse-cvrf логотип

SUSE-SU-2015:0865-1

suse-cvrf
больше 10 лет назад

Security update for ntp

EPSS

Процентиль: 90%
0.06205
Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-331