CVE-2015-7973

MEDIUM

NTP <4.2.8p6 & <4.3.90 - Info Disclosure

Title source: llm
STIX 2.1

Description

NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.

References (22)

Core 22
Core References
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3096-1
Vendor Advisory x_refsource_confirm
http://support.ntp.org/bin/view/Main/NtpBug2935
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034782
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
https://www.kb.cert.org/vuls/id/718152
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20171031-0001/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/81963
Third Party Advisory vendor-advisory x_refsource_freebsd
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc
Third Party Advisory x_refsource_confirm
https://bto.bluecoat.com/security-advisory/sa113
Broken Link vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201607-15
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
Third Party Advisory, US Government Resource x_refsource_confirm
https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11

Scores

CVSS v3 6.5
EPSS 0.0860
EPSS Percentile 92.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Details

CWE
CWE-254
Status published
Products (6)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
freebsd/freebsd 9.3 (20 CPE variants)
freebsd/freebsd 10.1 (22 CPE variants)
freebsd/freebsd 10.2 (5 CPE variants)
Published Jan 30, 2017
Tracked Since Feb 18, 2026