CVE-2015-7973

Description

NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.

Scores

Weaknesses (CWE)

• CWE-254

European references

• ENISA EUVD · EUVD-2015-7870
• GCVE · GCVE-0-2015-7973

CERT-FR advisories

• CERTFR-2021-AVI-255 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
• CERTFR-2017-AVI-111 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
• CERTFR-2016-AVI-045 — Multiples vulnérabilités dans les produits Cisco · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:* < 4.2.8
• cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:* ≥ 4.3.0 < 4.3.90
• cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p4:*:*:*:*:*:*
• cpe:2.3:a:ntp:ntp:4.2.8:p5:*:*:*:*:*:*
• cpe:2.3:o:siemens:tim_4r-ie_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:siemens:tim_4r-ie_dnp3_firmware:*:*:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:* ≥ 10.0 < 10.1
• cpe:2.3:o:freebsd:freebsd:9.3:-:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p1:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p10:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p12:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p13:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p16:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p19:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p2:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p20:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p21:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p22:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p23:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p24:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p25:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p3:*:*:*:*:*:*
• cpe:2.3:o:freebsd:freebsd:9.3:p5:*:*:*:*:*:*
• +39 more

Affected products

References

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd
• http://www.ubuntu.com/usn/USN-3096-1
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03766en_us
• http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
• http://support.ntp.org/bin/view/Main/NtpBug2935
• http://www.securitytracker.com/id/1034782
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html
• https://www.kb.cert.org/vuls/id/718152
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03750en_us
• https://security.netapp.com/advisory/ntap-20171031-0001/
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html
• http://www.securityfocus.com/bid/81963
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html
• https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc
• https://bto.bluecoat.com/security-advisory/sa113
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
• https://security.gentoo.org/glsa/201607-15
• https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
• https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11

Sources