{"id":"CVE-2015-3405","aliases":["DEBIAN-CVE-2015-3405","DLA-192-1","DSA-3223-1","EUVD-2015-3449","GHSA-wwx9-mwhp-g8mc","RHSA-2015:1459","RHSA-2015:2231","SUSE-SU-2015:0259-1","SUSE-SU-2015:0259-3","SUSE-SU-2015:0865-1","SUSE-SU-2015:1173-1","UBUNTU-CVE-2015-3405"],"status":"published","title":"ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys...","description":"ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.05292,"percentile":0.92625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-331"],"published":"2014-07-21T14:05:24Z","modified":"2026-08-27T23:00:57Z","fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.6.p5+dfsg-7"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ntp","fixed_in":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-7"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p2+dfsg-1+deb6u3"}]}],"versions":["1:4.2.6.p2+dfsg-1"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-2+deb7u4"}]}],"versions":["1:4.2.6.p5+dfsg-2","1:4.2.6.p5+dfsg-2+deb7u1","1:4.2.6.p5+dfsg-2+deb7u2","1:4.2.6.p5+dfsg-2+deb7u3"],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-5.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"sntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"ntpdate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.6p5-22.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-44.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-44.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-44.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.3"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"ntp","product":"ntp"},{"vendor":"opensuse","product":"suse_linux_enterprise_server"},{"vendor":"opensuse_project","product":"suse_linux_enterprise_desktop"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems"},{"vendor":"redhat","product":"enterprise_linux_for_power_big_endian"},{"vendor":"redhat","product":"enterprise_linux_for_scientific_computing"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_from_rhui_6"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"suse","product":"suse_linux_enterprise_server"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156248.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-2231.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1210324","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","advisory","fix","report"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3388","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00000.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/74045","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://bugs.ntp.org/show_bug.cgi?id=2797","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","Vendor Advisory","advisory","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1459.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03886en_us","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://bk1.ntp.org/ntp-stable/?PAGE=patch\u0026REV=55199296N2gFqH1Hm5GOnhrk9Ypygg","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3223","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/04/23/14","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3405","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1459","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:2231","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3405","tags":["report"]},{"url":"https://github.com/advisories/GHSA-wwx9-mwhp-g8mc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3405","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=995134","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1045376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1117704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1122015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1165141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1171630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184572","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184573","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1193849","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1193850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1199430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1199435","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1459.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9297","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9297","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#vallen_is_not_validated_in_sever","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9298","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9298","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9298","tags":["advisory"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#1_can_be_spoofed_on_some_OSes_so","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9750","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9750","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9751","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9751","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9751","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1798","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1798","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1799","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1799","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1799","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3405","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1117702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1122012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1171640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1180721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1191108","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1191122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1193154","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2231.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150259-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/838458","tags":["report"]},{"url":"https://bugzilla.suse.com/857195","tags":["report"]},{"url":"https://bugzilla.suse.com/883859","tags":["report"]},{"url":"https://bugzilla.suse.com/887957","tags":["report"]},{"url":"https://bugzilla.suse.com/910764","tags":["report"]},{"url":"https://bugzilla.suse.com/911792","tags":["report"]},{"url":"https://bugzilla.suse.com/924202","tags":["report"]},{"url":"https://bugzilla.suse.com/928321","tags":["report"]},{"url":"https://bugzilla.suse.com/935409","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3405","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150259-3/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/611513","tags":["report"]},{"url":"https://bugzilla.suse.com/645356","tags":["report"]},{"url":"https://bugzilla.suse.com/656345","tags":["report"]},{"url":"https://bugzilla.suse.com/680301","tags":["report"]},{"url":"https://bugzilla.suse.com/692969","tags":["report"]},{"url":"https://bugzilla.suse.com/730374","tags":["report"]},{"url":"https://bugzilla.suse.com/734467","tags":["report"]},{"url":"https://bugzilla.suse.com/758253","tags":["report"]},{"url":"https://bugzilla.suse.com/771480","tags":["report"]},{"url":"https://bugzilla.suse.com/817893","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150865-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/918342","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1798","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151173-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-3405","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/04/09/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2567-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-3405","description":"ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.","status":"published","published":"2017-08-09T16:00:00Z","modified":"2024-08-06T05:47:57.539Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3449","description":"ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.","status":"published","published":"2017-08-09T16:00:00Z","modified":"2024-08-06T05:47:57Z","updated_at":"2026-11-03T02:22:08.106657Z"}],"ghsa":[{"id":"GHSA-wwx9-mwhp-g8mc","title":"ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys...","description":"ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.","status":"published","published":"2022-05-13T01:26:15Z","modified":"2023-02-10T05:06:12Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:54:01.286462Z"}],"nvd":[{"id":"CVE-2015-3405","description":"ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.","status":"published","published":"2017-08-09T16:29:00.19Z","modified":"2026-06-17T00:25:52.583Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-331"],"updated_at":"2026-11-02T14:03:17.730372Z"}],"osv":[{"id":"CVE-2015-3405","description":"ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.","status":"published","published":"2017-08-09T16:29:00Z","modified":"2026-04-10T03:46:19.332725Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3405","description":"ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.","status":"published","published":"2017-08-09T16:29:00.19Z","modified":"2026-08-27T23:00:57.788136228Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"UBUNTU-CVE-2015-3405","description":"ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.","status":"published","published":"2017-08-09T16:29:00Z","modified":"2026-02-04T03:52:12.324472Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"DLA-192-1","title":"ntp - security update","status":"published","published":"2015-04-10T00:00:00Z","modified":"2026-03-09T01:20:31.832966Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-3223-1","title":"ntp - security update","status":"published","published":"2015-04-12T00:00:00Z","modified":"2026-03-09T01:18:03.202937Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"RHSA-2015:1459","title":"Red Hat Security Advisory: ntp security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:22:21Z","modified":"2026-06-26T12:21:49.209989474Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:2231","title":"Red Hat Security Advisory: ntp security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:22:28Z","modified":"2026-06-26T12:21:50.046767614Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2015:0259-1","title":"Recommended update for ntp","description":"\nThis update for ntp provides the following fixes:\n\n    * Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.\n      (bnc#887957)\n    * Fix orphan mode. (bnc#883859)\n\n","status":"published","published":"2014-11-18T12:31:05Z","modified":"2025-05-02T04:03:59.725525Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0259-3","title":"Security update for ntp","description":"\nThe NTP time service could have been used for remote denial of service \namplification attacks.\n\nThis issue can be fixed by the administrator as we described in our \nsecurity advisory SUSE-SA:2014:001\n\nhttp://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html\n\u003chttp://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html\u003e\n\nand on\n\nhttp://support.novell.com/security/cve/CVE-2013-5211.html\n\u003chttp://support.novell.com/security/cve/CVE-2013-5211.html\u003e\n\nthis update now also replaces the default ntp.conf template to fix this \nproblem.\n\nPlease note that if you have touched or modified ntp.conf yourself, it will \nnot be automatically fixed, you need to merge the changes manually as \ndescribed.\n\nAdditionally the following bug has been fixed:\n\n    * ntp start script does not update /var/lib/ntp/etc/localtime file if\n      /etc/localtime is symlink (bnc#838458)\n\nSecurity Issues:\n\n    * CVE-2013-5211\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211\u003e\n\n","status":"published","published":"2014-07-21T14:05:24Z","modified":"2026-02-04T03:48:05.752255Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0865-1","title":"Security update for ntp","description":"ntp was updated to fix two security related flaws as well as 'slew' mode handling for leap seconds. \n\nThe following vulnerabilities were fixe:\n\n* ntpd could accept unauthenticated packets with symmetric key crypto. (CVE-2015-1798)\n* ntpd authentication did not protect symmetric associations against DoS attacks (CVE-2015-1799)\n* ntp-keygen may generate non-random symmetric keys on big-endian systems (bsc#928321, CVE-2015-3405).\n\nThe following non-security issues were fixed:\n\n* Fix slew mode for leap seconds (bnc#918342).\n","status":"published","published":"2015-04-28T12:17:23Z","modified":"2026-02-04T02:31:52.175196Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1173-1","title":"Recommended update for ntp","description":"\nThis update for ntp provides the following fixes:\n\n    * Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.\n      (bnc#887957)\n    * Fix orphan mode. (bnc#883859)\n\n","status":"published","published":"2014-11-18T12:31:05Z","modified":"2025-05-02T04:03:59.848835Z","updated_at":"2026-11-02T15:53:43.030986Z"}]}}