CVE-2015-3405

Published: Aug 9, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

Affected (28)

Products: Ntp: Ntp · Debian: Debian Linux · Opensuse: Suse Linux Enterprise Server · +4 more

Show all products

1 product

1 product

1 product

Suse Linux Enterprise Server

Opensuse Project

1 product

Suse Linux Enterprise Desktop

1 product

Suse Linux Enterprise Server

1 product

7 products

Enterprise Linux Desktop

Enterprise Linux For Ibm Z Systems

Enterprise Linux For Power Big Endian

Enterprise Linux For Scientific Computing

Enterprise Linux Server

Enterprise Linux Server From Rhui 6

Enterprise Linux Workstation

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Ntp Ntp	Version 4.2.8 p1
Ntp Ntp	Version 4.2.8 p2-rc1
Ntp Ntp	Version 4.2.8 p2
Ntp Ntp	Version 4.3.0
Ntp Ntp	Version 4.3.10
Ntp Ntp	Version 4.3.11
Ntp Ntp	Version 4.3.1
Ntp Ntp	Version 4.3.2
Ntp Ntp	Version 4.3.3
Ntp Ntp	Version 4.3.4
Ntp Ntp	Version 4.3.5
Ntp Ntp	Version 4.3.6
Ntp Ntp	Version 4.3.7
Ntp Ntp	Version 4.3.8
Ntp Ntp	Version 4.3.9

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Suse Linux Enterprise Server	Version 11.0 sp3
Opensuse Project Suse Linux Enterprise Desktop	Version 11.0 sp3
Suse Suse Linux Enterprise Server	Version 11.0 sp3

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 21

Configuration E

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux For Ibm Z Systems	Version 6.0
Redhat Enterprise Linux For Power Big Endian	Version 6.0
Redhat Enterprise Linux For Scientific Computing	Version 6.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server From Rhui 6	Version 6.0
Redhat Enterprise Linux Workstation	Version 6.0

Related CWEs

Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References (28)

http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg

Source: secalert@redhat.com

Third Party AdvisoryVendor Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156248.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00000.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1459.html

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://rhn.redhat.com/errata/RHSA-2015-2231.html

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.debian.org/security/2015/dsa-3223

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2015/dsa-3388

Source: secalert@redhat.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/04/23/14

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/74045

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://bugs.ntp.org/show_bug.cgi?id=2797

Source: secalert@redhat.com

Issue TrackingThird Party AdvisoryVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1210324

Source: secalert@redhat.com

Issue TrackingPatchThird Party AdvisoryVDB Entry

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us

Source: secalert@redhat.com

http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVendor Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156248.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1459.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://rhn.redhat.com/errata/RHSA-2015-2231.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.debian.org/security/2015/dsa-3223

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2015/dsa-3388

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/04/23/14

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/74045

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://bugs.ntp.org/show_bug.cgi?id=2797

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party AdvisoryVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1210324

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party AdvisoryVDB Entry

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.