CVE-2015-7974

NameCVE-2015-7974
DescriptionNTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-559-1, DSA-3629-1
NVD severitylow (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ntp (PTS)wheezy1:4.2.6.p5+dfsg-2+deb7u6vulnerable
wheezy (security)1:4.2.6.p5+dfsg-2+deb7u7fixed
jessie (security), jessie1:4.2.6.p5+dfsg-7+deb8u2fixed
stretch1:4.2.8p10+dfsg-3+deb9u1fixed
buster, sid1:4.2.8p10+dfsg-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ntpsource(unstable)1:4.2.8p7+dfsg-1low
ntpsourcejessie1:4.2.6.p5+dfsg-7+deb8u2lowDSA-3629-1
ntpsourcewheezy1:4.2.6.p5+dfsg-2+deb7u7lowDLA-559-1

Notes

http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit
http://support.ntp.org/bin/view/Main/NtpBug2936

Search for package or bug name: Reporting problems