CVE-2015-8138 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 79%

Affected Products (NVD)

Vendor	Product	Version
ntp	ntp	𝑥 ≤ 4.2.8
ntp	ntp	4.3.0
ntp	ntp	4.3.1
ntp	ntp	4.3.2
ntp	ntp	4.3.3
ntp	ntp	4.3.4
ntp	ntp	4.3.5
ntp	ntp	4.3.6
ntp	ntp	4.3.7
ntp	ntp	4.3.8
ntp	ntp	4.3.10
ntp	ntp	4.3.11
ntp	ntp	4.3.12
ntp	ntp	4.3.13
ntp	ntp	4.3.14
ntp	ntp	4.3.15
ntp	ntp	4.3.16
ntp	ntp	4.3.17
ntp	ntp	4.3.18
ntp	ntp	4.3.19
ntp	ntp	4.3.20
ntp	ntp	4.3.21
ntp	ntp	4.3.22
ntp	ntp	4.3.23
ntp	ntp	4.3.24
ntp	ntp	4.3.25
ntp	ntp	4.3.26
ntp	ntp	4.3.27
ntp	ntp	4.3.28
ntp	ntp	4.3.29
ntp	ntp	4.3.30
ntp	ntp	4.3.31
ntp	ntp	4.3.32
ntp	ntp	4.3.33
ntp	ntp	4.3.34
ntp	ntp	4.3.35
ntp	ntp	4.3.36
ntp	ntp	4.3.37
ntp	ntp	4.3.38
ntp	ntp	4.3.39
ntp	ntp	4.3.40
ntp	ntp	4.3.41
ntp	ntp	4.3.42
ntp	ntp	4.3.43
ntp	ntp	4.3.44
ntp	ntp	4.3.45
ntp	ntp	4.3.46
ntp	ntp	4.3.47
ntp	ntp	4.3.48
ntp	ntp	4.3.49
ntp	ntp	4.3.50
ntp	ntp	4.3.51
ntp	ntp	4.3.52
ntp	ntp	4.3.53
ntp	ntp	4.3.54
ntp	ntp	4.3.55
ntp	ntp	4.3.56
ntp	ntp	4.3.57
ntp	ntp	4.3.58
ntp	ntp	4.3.59
ntp	ntp	4.3.60
ntp	ntp	4.3.61
ntp	ntp	4.3.62
ntp	ntp	4.3.63
ntp	ntp	4.3.64
ntp	ntp	4.3.65
ntp	ntp	4.3.66
ntp	ntp	4.3.67
ntp	ntp	4.3.68
ntp	ntp	4.3.69
ntp	ntp	4.3.70
ntp	ntp	4.3.71
ntp	ntp	4.3.72
ntp	ntp	4.3.73
ntp	ntp	4.3.74
ntp	ntp	4.3.75
ntp	ntp	4.3.76
ntp	ntp	4.3.77
ntp	ntp	4.3.78
ntp	ntp	4.3.79
ntp	ntp	4.3.80
ntp	ntp	4.3.81
ntp	ntp	4.3.82
ntp	ntp	4.3.83
ntp	ntp	4.3.84
ntp	ntp	4.3.85
ntp	ntp	4.3.86
ntp	ntp	4.3.87
ntp	ntp	4.3.88
ntp	ntp	4.3.89

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ntp

bullseye

1:4.2.8p15+dfsg-1

fixed

Ubuntu Releases

Ubuntu Product

Codename

ntp

precise	Fixed 1:4.2.6.p3+dfsg-1ubuntu3.11 released
trusty	Fixed 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 released
vivid	ignored
wily	ignored
xenial	Fixed 1:4.2.8p4+dfsg-3ubuntu5.3 released
yakkety	not-affected
zesty	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

yast2-ntp-client

suse enterprise sap 12	3.1.12.4-8.2 fixed
suse enterprise sap 12 SP1	3.1.22-6.2 fixed
suse enterprise server 12	3.1.12.4-8.2 fixed
suse enterprise server 12 SP1	3.1.22-6.2 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

ntp

RHEL 6	0:4.2.6p5-5.el6_7.4 fixed
RHEL 7	0:4.2.6p5-22.el7_2.1 fixed

ntp-doc

RHEL 6	0:4.2.6p5-5.el6_7.4 fixed
RHEL 7	0:4.2.6p5-22.el7_2.1 fixed

ntp-perl

RHEL 6	0:4.2.6p5-5.el6_7.4 fixed
RHEL 7	0:4.2.6p5-22.el7_2.1 fixed

ntpdate

RHEL 6	0:4.2.6p5-5.el6_7.4 fixed
RHEL 7	0:4.2.6p5-22.el7_2.1 fixed

sntp

RHEL 7

0:4.2.6p5-22.el7_2.1

fixed

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html

http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html

http://rhn.redhat.com/errata/RHSA-2016-0063.html

http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-ntpd

http://www.debian.org/security/2016/dsa-3629

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.securityfocus.com/bid/81811

http://www.securitytracker.com/id/1034782

http://www.ubuntu.com/usn/USN-3096-1

https://bto.bluecoat.com/security-advisory/sa113

https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf

https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03750en_us

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03766en_us

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc

https://security.gentoo.org/glsa/201607-15

https://security.netapp.com/advisory/ntap-20171004-0002/

https://security.netapp.com/advisory/ntap-20171031-0001/

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161123-ntpd

https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11

https://www.arista.com/en/support/advisories-notices/security-advisories/1332-security-advisory-19

https://www.kb.cert.org/vuls/id/718152

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html

http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html

http://rhn.redhat.com/errata/RHSA-2016-0063.html

http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-ntpd

http://www.debian.org/security/2016/dsa-3629

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.securityfocus.com/bid/81811

http://www.securitytracker.com/id/1034782

http://www.ubuntu.com/usn/USN-3096-1

https://bto.bluecoat.com/security-advisory/sa113

https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf

https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03750en_us

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03766en_us

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc

https://security.gentoo.org/glsa/201607-15

https://security.netapp.com/advisory/ntap-20171004-0002/

https://security.netapp.com/advisory/ntap-20171031-0001/

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161123-ntpd

https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11

https://www.arista.com/en/support/advisories-notices/security-advisories/1332-security-advisory-19

https://www.kb.cert.org/vuls/id/718152