CVE-2015-1798
Beschrijving
The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC.
Vendors
Affected products
References
- bugs.ntp.org
- lists.apple.com
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.opensuse.org
- marc.info
- rhn.redhat.com
- support.apple.com
- support.ntp.org
- tools.cisco.com
- tools.cisco.com
- www.debian.org
- www.kb.cert.org
- www.mandriva.com
- www.oracle.com
- www.oracle.com
- www.securityfocus.com
- www.securitytracker.com
- www.ubuntu.com
- kc.mcafee.com