CVE-2015-3405: debian debian_linux Insufficient Entropy
Vulnerability summary
CVE-2015-3405 is a high (CVSS 7.5) Insufficient Entropy vulnerability in debian debian_linux. EPSS estimates a 5.29% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 2Timeline
- 09-08-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
5.29%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 5.29% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat7 products
- enterprise_linux_desktop6.0
- enterprise_linux_for_ibm_z_systems6.0
- enterprise_linux_for_power_big_endian6.0
- enterprise_linux_for_scientific_computing6.0
- enterprise_linux_server6.0
Debian2 products
- ntp< 1:4.2.6.p5+dfsg-7
- debian_linuxEOL7.0 | 8.0
Fedoraproject1 product
- fedoraEOL21
Ntp1 product
- ntp4.2.8:p1 | 4.2.8:p2 | 4.2.8:p2-rc1 | 4.3.0 | 4.3.1 | 4.3.2 | 4.3.3 | 4.3.4 | 4.3.5 | 4.3.6 | 4.3.7 | 4.3.8 | 4.3.9 | 4.3.10 | 4.3.11
Opensuse1 product
- suse_linux_enterprise_server11.0:sp3
Opensuse_project1 product
- suse_linux_enterprise_desktop11.0:sp3
Suse1 product
- suse_linux_enterprise_server11.0:sp3
Ubuntu1 product
- ntp< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.3
8 vendors · 15 products
References
19 links- lists.fedoraproject.org/pipermail/package-announce/2015-April/156248.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- rhn.redhat.com/errata/RHSA-2015-2231.htmlVendor AdvisoryX Refsource REDHATThird Party AdvisoryVDB Entry
- bugzilla.redhat.com/show_bug.cgi?id=1210324X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryVDB Entry
- www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlX Refsource CONFIRM
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00000.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.htmlX Refsource CONFIRM
- bugs.ntp.org/show_bug.cgi?id=2797X Refsource CONFIRMIssue TrackingThird Party AdvisoryVendor Advisory
- rhn.redhat.com/errata/RHSA-2015-1459.htmlVendor AdvisoryX Refsource REDHATThird Party AdvisoryVDB Entry
Show all 19 references
- bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9YpyggX Refsource CONFIRMThird Party AdvisoryVendor Advisory