{"id":"CVE-2015-5146","aliases":["DEBIAN-CVE-2015-5146","DLA-335-1","DSA-3388-1","EUVD-2015-5158","GHSA-8463-8xmw-64wf","MGASA-2015-0348","UBUNTU-CVE-2015-5146","USN-2783-1"],"status":"published","title":"ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users...","description":"ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04913,"percentile":0.92173,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2015-07-02T00:00:00Z","modified":"2026-08-27T23:01:00Z","fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.8p3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ntp","fixed_in":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p2+dfsg-1+deb6u4"}]}],"versions":["1:4.2.6.p2+dfsg-1"],"bundled":16},{"source":"osv","ecosystem":"Debian:7","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-2+deb7u6"}]}],"versions":["1:4.2.6.p5+dfsg-2","1:4.2.6.p5+dfsg-2+deb7u1","1:4.2.6.p5+dfsg-2+deb7u2","1:4.2.6.p5+dfsg-2+deb7u3","1:4.2.6.p5+dfsg-2+deb7u4","1:4.2.6.p5+dfsg-2+deb7u5"],"bundled":16},{"source":"osv","ecosystem":"Debian:8","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-7+deb8u1"}]}],"versions":["1:4.2.6.p5+dfsg-7"],"bundled":16},{"source":"osv","ecosystem":"Mageia:4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-15.6.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-24.1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.5"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.5"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3"],"bundled":18}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"ntp","product":"ntp"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1238136","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/75589","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201509-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Mitigation","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1034168","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3388","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://bugs.ntp.org/show_bug.cgi?id=2853","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166992.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180731-0003/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5146"},{"url":"https://security.netapp.com/advisory/ntap-20180731-0003"},{"url":"https://github.com/advisories/GHSA-8463-8xmw-64wf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5146","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0348.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16322","tags":["report"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_NTP_Security_Vulnerabi","tags":["web","report"]},{"url":"http://openwall.com/lists/oss-security/2015/08/25/3","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-5146","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2783-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5195","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5196","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7691","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7701","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7702","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7703","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7704","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7705","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7850","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7853","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7871","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5146","description":"ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.","status":"published","published":"2017-08-24T20:00:00Z","modified":"2024-08-06T06:32:32.912Z","updated_at":"2026-11-02T14:35:40.217028Z"}],"euvd":[{"id":"EUVD-2015-5158","description":"ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.","status":"published","published":"2017-08-24T20:00:00Z","modified":"2024-08-06T06:32:32Z","updated_at":"2026-11-03T02:22:01.305851Z"}],"ghsa":[{"id":"GHSA-8463-8xmw-64wf","title":"ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users...","description":"ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.","status":"published","published":"2022-05-14T03:11:17Z","modified":"2025-04-20T03:43:49Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:50.574323Z"}],"nvd":[{"id":"CVE-2015-5146","description":"ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.","status":"published","published":"2017-08-24T20:29:00.313Z","modified":"2026-06-17T00:28:33.28Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:17.730372Z"}],"osv":[{"id":"CVE-2015-5146","description":"ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.","status":"published","published":"2017-08-24T20:29:00Z","modified":"2026-04-16T06:24:09.178954024Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5146","description":"ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.","status":"published","published":"2017-08-24T20:29:00.313Z","modified":"2026-08-27T23:01:00.653600529Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"UBUNTU-CVE-2015-5146","description":"ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.","status":"published","published":"2015-07-02T00:00:00Z","modified":"2026-02-04T02:31:46.722795Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"DLA-335-1","title":"ntp - security update","status":"published","published":"2015-10-28T00:00:00Z","modified":"2026-03-09T01:23:37.230378Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-3388-1","title":"ntp - security update","status":"published","published":"2015-11-01T00:00:00Z","modified":"2026-03-09T01:20:49.800811Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0348","title":"Updated ntp packages fix security vulnerabilities","description":"Updated ntp packages fix security vulnerability:\n\nA flaw was found in the way ntpd processed certain remote configuration\npackets. An attacker could use a specially crafted package to cause ntpd to\ncrash if the attacker had authenticated access to remote ntpd configuration\n(CVE-2015-5146).\n\nIt was found that ntpd could crash due to an uninitialized variable when\nprocessing malformed logconfig configuration commands, for example,\nntpq -c \":config logconfig a\" (CVE-2015-5194).\n\nIt was found that ntpd exits with a segmentation fault when a statistics\ntype that was not enabled during compilation (e.g. timingstats) is\nreferenced by the statistics or filegen configuration command, for example,\nntpq -c ':config statistics timingstats'\nntpq -c ':config filegen timingstats' (CVE-2015-5195).\n\nIt was found that the :config command can be used to set the pidfile and\ndriftfile paths without any restrictions. A remote attacker could use\nthis flaw to overwrite a file on the file system with a file containing\nthe pid of the ntpd process (immediately) or the current estimated drift\nof the system clock (in hourly intervals). For example,\nntpq -c ':config pidfile /tmp/ntp.pid'\nntpq -c ':config driftfile /tmp/ntp.drift' (CVE-2015-5196).\n\nIt was discovered that sntp would hang in an infinite loop when a\ncrafted NTP packet was received, related to the conversion of the\nprecision value in the packet to double (CVE-2015-5219).\n","status":"published","published":"2015-09-08T17:55:59Z","modified":"2026-04-16T06:23:59.384781567Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"USN-2783-1","title":"ntp vulnerabilities","description":"Aleksis Kauppinen discovered that NTP incorrectly handled certain remote\nconfig packets. In a non-default configuration, a remote authenticated\nattacker could possibly use this issue to cause NTP to crash, resulting in\na denial of service. (CVE-2015-5146)\n\nMiroslav Lichvar discovered that NTP incorrectly handled logconfig\ndirectives. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service. (CVE-2015-5194)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain statistics\ntypes. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service. (CVE-2015-5195)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain file\npaths. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service, or overwrite certain files. (CVE-2015-5196, CVE-2015-7703)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain packets.\nA remote attacker could possibly use this issue to cause NTP to hang,\nresulting in a denial of service. (CVE-2015-5219)\n\nAanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP\nincorrectly handled restarting after hitting a panic threshold. A remote\nattacker could possibly use this issue to alter the system time on clients.\n(CVE-2015-5300)\n\nIt was discovered that NTP incorrectly handled autokey data packets. A\nremote attacker could possibly use this issue to cause NTP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)\n\nIt was discovered that NTP incorrectly handled memory when processing\ncertain autokey messages. A remote attacker could possibly use this issue\nto cause NTP to consume memory, resulting in a denial of service.\n(CVE-2015-7701)\n\nAanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP\nincorrectly handled rate limiting. A remote attacker could possibly use\nthis issue to cause clients to stop updating their clock. (CVE-2015-7704,\nCVE-2015-7705)\n\nYves Younan discovered that NTP incorrectly handled logfile and keyfile\ndirectives. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to enter a loop, resulting in a\ndenial of service. (CVE-2015-7850)\n\nYves Younan and Aleksander Nikolich discovered that NTP incorrectly handled\nascii conversion. A remote attacker could possibly use this issue to cause\nNTP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2015-7852)\n\nYves Younan discovered that NTP incorrectly handled reference clock memory.\nA malicious refclock could possibly use this issue to cause NTP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-7853)\n\nJohn D \"Doug\" Birdwell discovered that NTP incorrectly handled decoding\ncertain bogus values. An attacker could possibly use this issue to cause\nNTP to crash, resulting in a denial of service. (CVE-2015-7855)\n\nStephen Gray discovered that NTP incorrectly handled symmetric association\nauthentication. A remote attacker could use this issue to possibly bypass\nauthentication and alter the system clock. (CVE-2015-7871)\n\nIn the default installation, attackers would be isolated by the NTP\nAppArmor profile.\n","status":"published","published":"2015-10-27T17:02:35Z","modified":"2026-02-10T04:40:56Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}