9.8

CVE-2015-7853

The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ntp ≫ Ntp Version >= 4.2.0 < 4.2.8
Ntp ≫ Ntp Version >= 4.3.0 < 4.3.77
Ntp ≫ Ntp Version4.2.8 Update-
Ntp ≫ Ntp Version4.2.8 Updatep1
Ntp ≫ Ntp Version4.2.8 Updatep1-beta1
Ntp ≫ Ntp Version4.2.8 Updatep1-beta2
Ntp ≫ Ntp Version4.2.8 Updatep1-beta3
Ntp ≫ Ntp Version4.2.8 Updatep1-beta4
Ntp ≫ Ntp Version4.2.8 Updatep1-beta5
Ntp ≫ Ntp Version4.2.8 Updatep1-rc1
Ntp ≫ Ntp Version4.2.8 Updatep1-rc2
Ntp ≫ Ntp Version4.2.8 Updatep2
Ntp ≫ Ntp Version4.2.8 Updatep2-rc1
Ntp ≫ Ntp Version4.2.8 Updatep2-rc2
Ntp ≫ Ntp Version4.2.8 Updatep2-rc3
Ntp ≫ Ntp Version4.2.8 Updatep3
Ntp ≫ Ntp Version4.2.8 Updatep3-rc1
Ntp ≫ Ntp Version4.2.8 Updatep3-rc2
Ntp ≫ Ntp Version4.2.8 Updatep3-rc3
Netapp ≫ Oncommand Balance Version-
Netapp ≫ Oncommand Unified Manager Version- SwPlatformclustered_data_ontap
Netapp ≫ Data Ontap Version- SwPlatform7-mode
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 11.78% 0.955
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

https://security.gentoo.org/glsa/201607-15
Third Party Advisory
VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11
http://www.securitytracker.com/id/1033951
Third Party Advisory
VDB Entry
https://security.netapp.com/advisory/ntap-20171004-0001/
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html
http://www.ubuntu.com/usn/USN-2783-1
http://lists.opensuse.org/opensuse-updates/2015-11/msg00093.html
http://packetstormsecurity.com/files/134137/Slackware-Security-Advisory-ntp-Updates.html
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-ntp
http://www.securityfocus.com/archive/1/536737/100/0/threaded
http://www.securityfocus.com/archive/1/536796/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/536737/100/100/threaded
http://www.securityfocus.com/archive/1/archive/1/536796/100/100/threaded
https://bto.bluecoat.com/security-advisory/sa103
http://packetstormsecurity.com/files/134082/FreeBSD-Security-Advisory-ntp-Authentication-Bypass.html
http://support.ntp.org/bin/view/Main/NtpBug2920
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/536760/100/0/threaded
http://www.securityfocus.com/archive/1/536833/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/536760/100/100/threaded
http://www.securityfocus.com/archive/1/archive/1/536833/100/100/threaded
http://www.securityfocus.com/bid/77273
Third Party Advisory
VDB Entry
http://www.talosintel.com/vulnerability-reports/
https://bugzilla.redhat.com/show_bug.cgi?id=1274262
Third Party Advisory
VDB Entry
Issue Tracking