CVE-2015-3405
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys...
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
- Record
CVE-2015-3405- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-331
- Updated
- 2026-11-02
CVE List No score
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
- Record
CVE-2015-3405- Updated
- 2026-11-02
EUVDEUVD-2015-3449 No score
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
- Record
EUVD-2015-3449- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wwx9-mwhp-g8mc
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys...
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
- Record
GHSA-wwx9-mwhp-g8mc- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-331
- Updated
- 2026-11-02
OSV
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
- Record
CVE-2015-3405- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-3405
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
- Record
DEBIAN-CVE-2015-3405- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2015-3405
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
- Record
UBUNTU-CVE-2015-3405- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVSUSE-SU-2015:0259-1 No score
Recommended update for ntp
This update for ntp provides the following fixes:
* Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.
(bnc#887957)
* Fix orphan mode. (bnc#883859)
- Record
SUSE-SU-2015:0259-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0259-3 No score
Security update for ntp
The NTP time service could have been used for remote denial of service amplification attacks.
This issue can be fixed by the administrator as we described in our security advisory SUSE-SA:2014:001
http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html
and on
http://support.novell.com/security/cve/CVE-2013-5211.html http://support.novell.com/security/cve/CVE-2013-5211.html
this update now also replaces the default ntp.conf template to fix this problem.
Please note that if you have touched or modified ntp.conf yourself, it will not be automatically fixed, you need to merge the changes manually as described.
Additionally the following bug has been fixed:
* ntp start script does not update /var/lib/ntp/etc/localtime file if
/etc/localtime is symlink (bnc#838458)
Security Issues:
* CVE-2013-5211
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211>
- Record
SUSE-SU-2015:0259-3- Updated
- 2026-11-02
OSVSUSE-SU-2015:0865-1 No score
Security update for ntp
ntp was updated to fix two security related flaws as well as 'slew' mode handling for leap seconds.
The following vulnerabilities were fixe:
- ntpd could accept unauthenticated packets with symmetric key crypto. (CVE-2015-1798)
- ntpd authentication did not protect symmetric associations against DoS attacks (CVE-2015-1799)
- ntp-keygen may generate non-random symmetric keys on big-endian systems (bsc#928321, CVE-2015-3405).
The following non-security issues were fixed:
- Fix slew mode for leap seconds (bnc#918342).
- Record
SUSE-SU-2015:0865-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1173-1 No score
Recommended update for ntp
This update for ntp provides the following fixes:
* Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.
(bnc#887957)
* Fix orphan mode. (bnc#883859)
- Record
SUSE-SU-2015:1173-1- Updated
- 2026-11-02
Affected products
- ntp
- debian linux
- fedoraproject fedora
- opensuse suse linux enterprise server
- opensuse project suse linux enterprise desktop
- redhat enterprise linux desktop
- redhat enterprise linux for ibm z systems
- redhat enterprise linux for power big endian
- redhat enterprise linux for scientific computing
- redhat enterprise linux server
- redhat enterprise linux server from rhui 6
- redhat enterprise linux workstation
Show 1 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ntpDebian:11 |
before 1:4.2.6.p5+dfsg-7 | 1:4.2.6.p5+dfsg-7 |
ntpDebian:6.0 From an advisory covering 3 CVEs |
before 1:4.2.6.p2+dfsg-1+deb6u3, plus listed versions 1:4.2.6.p2+dfsg-1 |
1:4.2.6.p2+dfsg-1+deb6u3 |
ntpDebian:7 From an advisory covering 3 CVEs |
before 1:4.2.6.p5+dfsg-2+deb7u4, plus listed versions 1:4.2.6.p5+dfsg-21:4.2.6.p5+dfsg-2+deb7u11:4.2.6.p5+dfsg-2+deb7u21:4.2.6.p5+dfsg-2+deb7u3 |
1:4.2.6.p5+dfsg-2+deb7u4 |
ntp-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntp-docRed Hat:enterprise_linux:6::client From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntp-perlRed Hat:enterprise_linux:6::client From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntpRed Hat:enterprise_linux:6::client From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntpdateRed Hat:enterprise_linux:6::client From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntp-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntp-docRed Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ntp-perlRed Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntpRed Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntpdateRed Hat:enterprise_linux:6::computenode From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntp-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntp-docRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntp-perlRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntpRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntpdateRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntp-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntp-docRed Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntp-perlRed Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntpRed Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntpdateRed Hat:enterprise_linux:6::workstation From an advisory covering 7 CVEs |
before 0:4.2.6p5-5.el6 | 0:4.2.6p5-5.el6 |
ntp-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntp-docRed Hat:enterprise_linux:7::client From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntp-perlRed Hat:enterprise_linux:7::client From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
sntpRed Hat:enterprise_linux:7::client From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntpRed Hat:enterprise_linux:7::client From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntpdateRed Hat:enterprise_linux:7::client From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntp-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntp-docRed Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntp-perlRed Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
sntpRed Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntpRed Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntpdateRed Hat:enterprise_linux:7::computenode From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntp-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntp-docRed Hat:enterprise_linux:7::server From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntp-perlRed Hat:enterprise_linux:7::server From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
sntpRed Hat:enterprise_linux:7::server From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntpRed Hat:enterprise_linux:7::server From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntpdateRed Hat:enterprise_linux:7::server From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntp-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntp-docRed Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntp-perlRed Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
sntpRed Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntpRed Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntpdateRed Hat:enterprise_linux:7::workstation From an advisory covering 7 CVEs |
before 0:4.2.6p5-22.el7 | 0:4.2.6p5-22.el7 |
ntpSUSE:Linux Enterprise Desktop 12 From an advisory covering 3 CVEs |
before 4.2.6p5-44.1 | 4.2.6p5-44.1 |
ntpSUSE:Linux Enterprise Server 12 From an advisory covering 3 CVEs |
before 4.2.6p5-44.1 | 4.2.6p5-44.1 |
ntpSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 3 CVEs |
before 4.2.6p5-44.1 | 4.2.6p5-44.1 |
ntpUbuntu:14.04:LTS |
before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.3, plus listed versions 1:4.2.6.p5+dfsg-3ubuntu21:4.2.6.p5+dfsg-3ubuntu2.14.04.11:4.2.6.p5+dfsg-3ubuntu2.14.04.2 |
1:4.2.6.p5+dfsg-3ubuntu2.14.04.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3405 is a high vulnerability (CVSS 7.5) in Ntp, published July 21, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.29%, the 92nd percentile. Fixed in ntp 1:4.2.6.p5+dfsg-7.
References
lists.fedoraproject.org/pipermail/package-announce/2015-April/156248.html
rhn.redhat.com/errata/RHSA-2015-2231.html
bugzilla.redhat.com/show_bug.cgi?id=1210324
oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
debian.org/security/2015/dsa-3388
lists.opensuse.org/opensuse-security-announce/2015-07/msg00000.html
Show 94 moreShow less
securityfocus.com/bid/74045
bugs.ntp.org/show_bug.cgi?id=2797
support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us
bk1.ntp.org/ntp-stable?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg
openwall.com/lists/oss-security/2015/04/23/14
nvd.nist.gov/vuln/detail/CVE-2015-3405
access.redhat.com/errata/RHSA-2015:1459
github.com/advisories/GHSA-wwx9-mwhp-g8mc
security-tracker.debian.org/tracker/CVE-2015-3405
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1459.json
cve.org/CVERecord?id=CVE-2014-9297
support.ntp.org/bin/view/Main/SecurityNotice
suse.com/support/update/announcement/2015/suse-su-20150259-1
bugzilla.suse.com/838458
ubuntu.com/security/CVE-2015-3405