QwikSec

Security Database

CVE

CWE

Training

CVE-2015-3405

Published: Aug 9, 2017

Modified: Aug 6, 2024

PUBLISHED

Description

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

FEDORA-2015-5830

vendor-advisory

x_refsource_FEDORA

vendor-advisory

x_refsource_REDHAT

https://bugzilla.redhat.com/show_bug.cgi?id=1210324

x_refsource_CONFIRM

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_DEBIAN

SUSE-SU-2015:1173

vendor-advisory

x_refsource_SUSE

vdb-entry

x_refsource_BID

http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html

x_refsource_CONFIRM

https://bugs.ntp.org/show_bug.cgi?id=2797

x_refsource_CONFIRM

vendor-advisory

x_refsource_REDHAT

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us

x_refsource_CONFIRM

http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg

x_refsource_CONFIRM

vendor-advisory

x_refsource_DEBIAN

[oss-security] 20150423 Re: CVE request: ntp-keygen may generate non-random symmetric keys on big-endian systems

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.