CVE-2015-5300

Published: Jul 21, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

Affected (38)

Products: Fedoraproject: Fedora · Opensuse: Leap, Opensuse · Suse: Linux Enterprise Debuginfo, Linux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit, Manager, Manager Proxy, Openstack Cloud, Suse Linux Enterprise Server · +4 more

Show all products

1 product

2 products

8 products

Linux Enterprise Debuginfo

Linux Enterprise Desktop

Linux Enterprise Server

Linux Enterprise Software Development Kit

Manager

Manager Proxy

Openstack Cloud

Suse Linux Enterprise Server

Redhat

6 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Hpc Node Eus

Enterprise Linux Server

Enterprise Linux Server Eus

Enterprise Linux Workstation

1 product

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 21
Fedoraproject Fedora	Version 22

Configuration B

18 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.1
Opensuse Opensuse	Version 13.2
Suse Linux Enterprise Debuginfo	Version 11 sp2
Suse Linux Enterprise Debuginfo	Version 11 sp3
Suse Linux Enterprise Debuginfo	Version 11 sp4
Suse Linux Enterprise Desktop	Version 12
Suse Linux Enterprise Desktop	Version 12 sp1
Suse Linux Enterprise Server	Version 10 sp4
Suse Linux Enterprise Server	Version 11 sp2
Suse Linux Enterprise Server	Version 11 sp3
Suse Linux Enterprise Server	Version 11 sp4
Suse Linux Enterprise Server	Version 12 sp1
Suse Linux Enterprise Software Development Kit	Version 12
Suse Linux Enterprise Software Development Kit	Version 12 sp1
Suse Manager	Version 2.1
Suse Manager Proxy	Version 2.1
Suse Openstack Cloud	Version 5
Suse Suse Linux Enterprise Server	Version 12

Configuration C

11 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node	Version 6.0
Redhat Enterprise Linux Hpc Node	Version 7.0
Redhat Enterprise Linux Hpc Node Eus	Version 7.1
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Eus	Version 6.7.z
Redhat Enterprise Linux Server Eus	Version 7.1
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration E

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.04
Canonical Ubuntu Linux	Version 15.10

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Ntp Ntp	Up to 4.2.8

Related CWEs

CWE-361

References (78)

http://aix.software.ibm.com/aix/efixes/security/ntp_advisory5.asc

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170684.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1930.html

Source: secalert@redhat.com

Third Party Advisory

http://seclists.org/bugtraq/2016/Feb/164

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://support.ntp.org/bin/view/Main/NtpBug2956

Source: secalert@redhat.com

Issue TrackingPatchVendor Advisory

http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit

Source: secalert@redhat.com

Issue TrackingPatchVendor Advisory

http://www.debian.org/security/2015/dsa-3388

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/77312

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1034670

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2783-1

Source: secalert@redhat.com

Third Party Advisory

https://bto.bluecoat.com/security-advisory/sa113

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1271076

Source: secalert@redhat.com

Issue Tracking

https://ics-cert.us-cert.gov/advisories/ICSA-15-356-01

Source: secalert@redhat.com

Third Party AdvisoryUS Government Resource

https://security.netapp.com/advisory/ntap-20171004-0001/

Source: secalert@redhat.com

https://support.citrix.com/article/CTX220112

Source: secalert@redhat.com

Third Party Advisory

https://www-01.ibm.com/support/docview.wss?uid=isg3T1023885

Source: secalert@redhat.com

Third Party Advisory

https://www-01.ibm.com/support/docview.wss?uid=isg3T1024073

Source: secalert@redhat.com

Third Party Advisory

https://www-01.ibm.com/support/docview.wss?uid=nas8N1021264

Source: secalert@redhat.com

Third Party Advisory

https://www-01.ibm.com/support/docview.wss?uid=ssg1S1005821

Source: secalert@redhat.com

Third Party Advisory

https://www-01.ibm.com/support/docview.wss?uid=swg21979393

Source: secalert@redhat.com

Third Party Advisory

https://www-01.ibm.com/support/docview.wss?uid=swg21980676

Source: secalert@redhat.com

Third Party Advisory

https://www-01.ibm.com/support/docview.wss?uid=swg21983501

Source: secalert@redhat.com

Third Party Advisory

https://www-01.ibm.com/support/docview.wss?uid=swg21983506

Source: secalert@redhat.com

Third Party Advisory

https://www.cs.bu.edu/~goldbe/NTPattack.html

Source: secalert@redhat.com

Third Party Advisory

https://www.freebsd.org/security/advisories/FreeBSD-SA-16:02.ntp.asc

Source: secalert@redhat.com

Third Party Advisory

https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099428

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: secalert@redhat.com

Third Party Advisory

http://aix.software.ibm.com/aix/efixes/security/ntp_advisory5.asc