CVE-2015-7974
Fixed in a distro release EPSS 6%
NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
Products: ntp, siemens tim_4r-ie_firmware, siemens tim_4r-ie_dnp3_firmware, netapp clustered_data_ontap, netapp oncommand_balance, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | ntp | 1:4.2.8p7+dfsg-1 |
| Debian 7 | ntp | 1:4.2.6.p5+dfsg-2+deb7u7 |
| Debian 8 | ntp | 1:4.2.6.p5+dfsg-7+deb8u2 |
| Red Hat Enterprise Linux 7 | ntp | 0:4.2.6p5-25.el7 |
| Red Hat Enterprise Linux 7 | ntp-debuginfo | 0:4.2.6p5-25.el7 |
| Red Hat Enterprise Linux 7 | ntp-doc | 0:4.2.6p5-25.el7 |
| Red Hat Enterprise Linux 7 | ntp-perl | 0:4.2.6p5-25.el7 |
| Red Hat Enterprise Linux 7 | ntpdate | 0:4.2.6p5-25.el7 |
| Red Hat Enterprise Linux 7 | sntp | 0:4.2.6p5-25.el7 |
| SUSE Linux Enterprise Desktop 12 | ntp | 4.2.8p8-46.8.1 |
| SUSE Linux Enterprise Desktop 12 | ntp | 4.2.8p6-46.5.2 |
| SUSE Linux Enterprise Desktop 12 | yast2-ntp-client | 3.1.12.4-8.2 |
| SUSE Linux Enterprise Desktop 12 SP1 | ntp | 4.2.8p6-8.2 |
| SUSE Linux Enterprise Desktop 12 SP1 | ntp | 4.2.8p7-11.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | yast2-ntp-client | 3.1.22-6.2 |
| SUSE Linux Enterprise Server 11 SP2-LTSS | ntp | 4.2.8p7-44.1 |
| SUSE Linux Enterprise Server 11 SP2-LTSS | ntp | 4.2.8p6-41.1 |
| SUSE Linux Enterprise Server 11 SP2-LTSS | yast2-ntp-client | 2.17.14.1-1.12.1 |
| SUSE Linux Enterprise Server 11 SP3-LTSS | ntp | 4.2.8p6-41.1 |
| SUSE Linux Enterprise Server 11 SP3-LTSS | ntp | 4.2.8p7-44.1 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | ntp | 4.2.8p7-44.1 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | ntp | 4.2.8p6-41.1 |
| SUSE Linux Enterprise Server 11 SP4 | ntp | 4.2.8p6-8.2 |
| SUSE Linux Enterprise Server 11 SP4 | ntp | 4.2.8p7-11.1 |
| SUSE Linux Enterprise Server 12 | ntp | 4.2.8p6-46.5.2 |
| SUSE Linux Enterprise Server 12 | ntp | 4.2.8p8-46.8.1 |
| SUSE Linux Enterprise Server 12 | yast2-ntp-client | 3.1.12.4-8.2 |
| SUSE Linux Enterprise Server 12 SP1 | ntp | 4.2.8p6-8.2 |
| SUSE Linux Enterprise Server 12 SP1 | ntp | 4.2.8p7-11.1 |
| SUSE Linux Enterprise Server 12 SP1 | yast2-ntp-client | 3.1.22-6.2 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | ntp | 4.2.8p7-11.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | ntp | 4.2.8p6-8.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 | ntp | 4.2.8p8-46.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | ntp | 4.2.8p6-46.5.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 | yast2-ntp-client | 3.1.12.4-8.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | ntp | 4.2.8p7-11.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | ntp | 4.2.8p6-8.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | yast2-ntp-client | 3.1.22-6.2 |
| SUSE Linux Enterprise Software Development Kit 12 | yast2-ntp-client | 3.1.12.4-8.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | yast2-ntp-client | 3.1.22-6.2 |
| SUSE Manager 2.1 | ntp | 4.2.8p6-41.1 |
| SUSE Manager 2.1 | ntp | 4.2.8p7-44.1 |
| SUSE Manager Proxy 2.1 | ntp | 4.2.8p6-41.1 |
| SUSE Manager Proxy 2.1 | ntp | 4.2.8p7-44.1 |
| SUSE OpenStack Cloud 5 | ntp | 4.2.8p7-44.1 |
| SUSE OpenStack Cloud 5 | ntp | 4.2.8p6-41.1 |
| Ubuntu 14.04 LTS | ntp | 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 |
| Ubuntu 16.04 LTS | ntp | 1:4.2.8p4+dfsg-3ubuntu5.3 |
| openSUSE Tumbleweed | ntp | 4.2.8p9-1.1 |