CVE-2015-5194

high-risk

Published 2017-07-21

The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.

Do I need to act?

8.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (20)

Linux Enterprise Debuginfo

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Server

Enterprise Linux Workstation

Debian Linux

Ubuntu Linux

Ntp

Fedora

Linux Enterprise Debuginfo

Linux Enterprise Server

Affected Vendors

Fedoraproject Suse Ntp Debian Canonical Redhat

References (40)

Issue Tracking http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=4c4fc141LwvcoGp-lLGhkAFp3ZvtrA

Third Party Advisory http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.h...

Third Party Advisory http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.ht...

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-0780.html

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-2583.html

Third Party Advisory http://www.debian.org/security/2015/dsa-3388

Mailing List http://www.openwall.com/lists/oss-security/2015/08/25/3

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.h...

Third Party Advisory http://www.securityfocus.com/bid/76475

Third Party Advisory http://www.ubuntu.com/usn/USN-2783-1

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1254542

Issue Tracking https://github.com/ntp-project/ntp/commit/553f2fa65865c31c5e3c48812cfd46176cffdd...

Third Party Advisory https://www-01.ibm.com/support/docview.wss?uid=isg3T1024157

Third Party Advisory https://www-01.ibm.com/support/docview.wss?uid=swg21985122

Third Party Advisory https://www-01.ibm.com/support/docview.wss?uid=swg21986956

Third Party Advisory https://www-01.ibm.com/support/docview.wss?uid=swg21988706

Third Party Advisory https://www-01.ibm.com/support/docview.wss?uid=swg21989542

and 20 more references

/ 100

high-risk

Severity 26/34 · High

Exploitability 10/34 · Low

Exposure 21/34 · High