UBUNTU-CVE-2015-3405

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2015-3405

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-3405.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2015-3405

Related

Published

2017-08-09T16:29:00Z

Modified

2017-08-09T16:29:00Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

References

Affected packages

Ubuntu:14.04:LTS / ntp

Package

Name: ntp
Purl: pkg:deb/ubuntu/ntp?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:4.2.6.p5+dfsg-3ubuntu2.14.04.3

Affected versions

1:4.*

1:4.2.6.p5+dfsg-3ubuntu2

1:4.2.6.p5+dfsg-3ubuntu2.14.04.1

1:4.2.6.p5+dfsg-3ubuntu2.14.04.2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "1:4.2.6.p5+dfsg-3ubuntu2.14.04.3",
            "binary_name": "ntp"
        },
        {
            "binary_version": "1:4.2.6.p5+dfsg-3ubuntu2.14.04.3",
            "binary_name": "ntp-doc"
        },
        {
            "binary_version": "1:4.2.6.p5+dfsg-3ubuntu2.14.04.3",
            "binary_name": "ntpdate"
        }
    ]
}