CVE-2015-3405

Fixed in a distro release EPSS 5%

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

Published 2017-08-09 · CVE record · OSV

Products: ntp, debian_linux, opensuse suse_linux_enterprise_server, opensuse_project suse_linux_enterprise_desktop, suse_linux_enterprise_server, fedoraproject fedora, redhat enterprise_linux_desktop, redhat enterprise_linux_for_ibm_z_systems, redhat enterprise_linux_for_power_big_endian, redhat enterprise_linux_for_scientific_computing, redhat enterprise_linux_server, redhat enterprise_linux_server_from_rhui_6, redhat enterprise_linux_workstation

Distro releases