Home > Vulnerability Database > CVE-2015-5300

Mend.io Vulnerability Database

CVE-2015-5300

Good to know:

Date: July 21, 2017

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

Language: C

Severity Score

7.5

Related Resources (44)

Url: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html

Url: https://security.netapp.com/advisory/ntap-20171004-0001/

Url: http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Url: https://security-tracker.debian.org/tracker/CVE-2015-5300

Url: https://www-01.ibm.com/support/docview.wss?uid=swg21983501

Url: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html

Url: http://rhn.redhat.com/errata/RHSA-2015-1930.html

Url: https://support.citrix.com/article/CTX220112

Url: http://aix.software.ibm.com/aix/efixes/security/ntp_advisory5.asc

Url: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html

Url: https://www-01.ibm.com/support/docview.wss?uid=nas8N1021264

Url: https://www-01.ibm.com/support/docview.wss?uid=swg21980676

Url: https://www-01.ibm.com/support/docview.wss?uid=isg3T1023885

Url: http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit

Url: http://www.securitytracker.com/id/1034670

Url: http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html

Url: https://www-01.ibm.com/support/docview.wss?uid=swg21983506

Url: https://ics-cert.us-cert.gov/advisories/ICSA-15-356-01

Url: https://www-01.ibm.com/support/docview.wss?uid=isg3T1024073

Url: https://bto.bluecoat.com/security-advisory/sa113

Url: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html

Url: https://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Url: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html

Url: https://access.redhat.com/security/cve/CVE-2015-5300

Url: http://www.debian.org/security/2015/dsa-3388

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2015-5300

Url: https://www.freebsd.org/security/advisories/FreeBSD-SA-16:02.ntp.asc

Url: https://www-01.ibm.com/support/docview.wss?uid=swg21979393

Url: http://seclists.org/bugtraq/2016/Feb/164

Url: http://www.securityfocus.com/bid/77312

Url: https://www-01.ibm.com/support/docview.wss?uid=ssg1S1005821

Url: http://www.ubuntu.com/usn/USN-2783-1

Url: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html

Url: https://bugzilla.redhat.com/show_bug.cgi?id=1271076

Url: http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html

Url: https://www.cs.bu.edu/~goldbe/NTPattack.html

Url: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170684.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2015-5300

Url: https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099428

Url: https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Url: http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html

Url: http://support.ntp.org/bin/view/Main/NtpBug2956

Url: http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html

Url: https://www.mend.io/vulnerability-database/CVE-2015-5300

Severity Score

7.5

Weakness Type (CWE)

Time and State

CWE-361

Top Fix

Upgrade Version

Upgrade to version 4.2.8p5

Learn More

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	HIGH

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2015-5300

Good to know:

Date: July 21, 2017

Language: C

Severity Score

Related Resources (44)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?