{"schemaVersion":3,"id":"USN-2783-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"ntp vulnerabilities\n\nAleksis Kauppinen discovered that NTP incorrectly handled certain remote\nconfig packets. In a non-default configuration, a remote authenticated\nattacker could possibly use this issue to cause NTP to crash, resulting in\na denial of service. (CVE-2015-5146)\n\nMiroslav Lichvar discovered that NTP incorrectly handled logconfig\ndirectives. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service. (CVE-2015-5194)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain statistics\ntypes. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service. (CVE-2015-5195)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain file\npaths. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to crash, resulting in a denial\nof service, or overwrite certain files. (CVE-2015-5196, CVE-2015-7703)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain packets.\nA remote attacker could possibly use this issue to cause NTP to hang,\nresulting in a denial of service. (CVE-2015-5219)\n\nAanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP\nincorrectly handled restarting after hitting a panic threshold. A remote\nattacker could possibly use this issue to alter the system time on clients.\n(CVE-2015-5300)\n\nIt was discovered that NTP incorrectly handled autokey data packets. A\nremote attacker could possibly use this issue to cause NTP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)\n\nIt was discovered that NTP incorrectly handled memory when processing\ncertain autokey messages. A remote attacker could possibly use this issue\nto cause NTP to consume memory, resulting in a denial of service.\n(CVE-2015-7701)\n\nAanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP\nincorrectly handled rate limiting. A remote attacker could possibly use\nthis issue to cause clients to stop updating their clock. (CVE-2015-7704,\nCVE-2015-7705)\n\nYves Younan discovered that NTP incorrectly handled logfile and keyfile\ndirectives. In a non-default configuration, a remote authenticated attacker\ncould possibly use this issue to cause NTP to enter a loop, resulting in a\ndenial of service. (CVE-2015-7850)\n\nYves Younan and Aleksander Nikolich discovered that NTP incorrectly handled\nascii conversion. A remote attacker could possibly use this issue to cause\nNTP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2015-7852)\n\nYves Younan discovered that NTP incorrectly handled reference clock memory.\nA malicious refclock could possibly use this issue to cause NTP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-7853)\n\nJohn D \"Doug\" Birdwell discovered that NTP incorrectly handled decoding\ncertain bogus values. An attacker could possibly use this issue to cause\nNTP to crash, resulting in a denial of service. (CVE-2015-7855)\n\nStephen Gray discovered that NTP incorrectly handled symmetric association\nauthentication. A remote attacker could use this issue to possibly bypass\nauthentication and alter the system clock. (CVE-2015-7871)\n\nIn the default installation, attackers would be isolated by the NTP\nAppArmor profile.","dates":{"published":"2015-10-27T17:02:35.000Z","modified":"2026-02-10T04:40:56.000Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"ntp","name":"ntp","label":"ntp","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/ntp","purlType":"deb","versions":[{"text":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-2783-1","label":"ubuntu.com/security/notices/USN-2783-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5146","label":"ubuntu.com/security/CVE-2015-5146","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-5194","label":"ubuntu.com/security/CVE-2015-5194","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-5195","label":"ubuntu.com/security/CVE-2015-5195","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-5196","label":"ubuntu.com/security/CVE-2015-5196","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-5219","label":"ubuntu.com/security/CVE-2015-5219","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-5300","label":"ubuntu.com/security/CVE-2015-5300","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7691","label":"ubuntu.com/security/CVE-2015-7691","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7692","label":"ubuntu.com/security/CVE-2015-7692","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7701","label":"ubuntu.com/security/CVE-2015-7701","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7702","label":"ubuntu.com/security/CVE-2015-7702","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7703","label":"ubuntu.com/security/CVE-2015-7703","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7704","label":"ubuntu.com/security/CVE-2015-7704","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7705","label":"ubuntu.com/security/CVE-2015-7705","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7850","label":"ubuntu.com/security/CVE-2015-7850","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7852","label":"ubuntu.com/security/CVE-2015-7852","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7853","label":"ubuntu.com/security/CVE-2015-7853","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7855","label":"ubuntu.com/security/CVE-2015-7855","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2015-7871","label":"ubuntu.com/security/CVE-2015-7871","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2015-5146","CVE-2015-5194","CVE-2015-5195","CVE-2015-5196","CVE-2015-5219","CVE-2015-5300","CVE-2015-7691","CVE-2015-7692","CVE-2015-7701","CVE-2015-7702","CVE-2015-7703","CVE-2015-7704","CVE-2015-7705","CVE-2015-7850","CVE-2015-7852","CVE-2015-7853","CVE-2015-7855","CVE-2015-7871"],"downstream":[],"duplicates":[],"related":["CVE-2015-5146","CVE-2015-5194","CVE-2015-5195","CVE-2015-5196","CVE-2015-5219","CVE-2015-5300","CVE-2015-7691","CVE-2015-7692","CVE-2015-7701","CVE-2015-7702","CVE-2015-7703","CVE-2015-7704","CVE-2015-7705","CVE-2015-7850","CVE-2015-7852","CVE-2015-7853","CVE-2015-7855","CVE-2015-7871"]},"timeline":[{"kind":"published","date":"2015-10-27T17:02:35.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-10T04:40:56.000Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T16:40:26.663Z","stale":false,"partial":false}}