Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2015-7974

Date: January 26, 2016

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."

Severity Score

Related Resources (19)

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03750en_us
http://rhn.redhat.com/errata/RHSA-2016-2583.html
http://www.talosintel.com/reports/TALOS-2016-0071/
http://www.debian.org/security/2016/dsa-3629
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc
https://access.redhat.com/security/cve/CVE-2015-7974
https://security-tracker.debian.org/tracker/CVE-2015-7974
https://people.canonical.com/~ubuntu-security/cve/CVE-2015-7974
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03766en_us
https://security.netapp.com/advisory/ntap-20171031-0001/
https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
http://www.securitytracker.com/id/1034782
http://www.securityfocus.com/bid/81960
https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
http://support.ntp.org/bin/view/Main/NtpBug2936
https://security.gentoo.org/glsa/201607-15
http://bugs.ntp.org/show_bug.cgi?id=2936
https://nvd.nist.gov/vuln/detail/CVE-2015-7974
https://www.mend.io/vulnerability-database/CVE-2015-7974

Severity Score

Weakness Type (CWE)

Improper Authentication

CWE-287

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): SINGLE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us