CVE-2015-1799

Severity CVSS v4.0:

Pending analysis

Type:

CWE-17 Code Errors

Publication date:

08/04/2015

Last modified:

12/04/2025

Description

The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer.

Impact

Vector 2.0

AV:A/AC:M/Au:N/C:N/I:P/A:P CVSS v2.0 Severity and Metrics:

Base Score: 4.30 MEDIUM
Vector: AV:A/AC:M/Au:N/C:N/I:P/A:P

Attack Vector (AV): Adjacent
Attack Complexity (AC): Medium
Authentication (Au): None
Confidentiality (C): None
Integrity (I): Physical
Availability (A): Physical