NVD Vulnerability Detail

CVE-2015-5300

Summary	The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).
Publication Date	July 21, 2017, 11:29 p.m.
Registration Date	Jan. 26, 2021, 2:52 p.m.
Last Update	Nov. 21, 2024, 11:32 a.m.

CVSS3.0 : HIGH
スコア	7.5
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	高

CVSS2.0 : MEDIUM
Score	5.0
Vector	AV:N/AC:L/Au:N/C:N/I:N/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:fedoraproject:fedora:22:::::::*
cpe:2.3:o:fedoraproject:fedora:21:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_server:11:sp4::::::
cpe:2.3:o:suse:manager_proxy:2.1:::::::*
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1::::::
cpe:2.3:o:suse:manager:2.1:::::::*
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:::ltss:::*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:::::::*
cpe:2.3:o:suse:linux_enterprise_server:12:sp1::::::
cpe:2.3:o:suse:openstack_cloud:5:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:12:::::::*
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:::ltss:::*
cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1::::::
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:::ltss:::*
cpe:2.3:o:opensuse:leap:42.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.2:::::::*
cpe:2.3:o:suse:suse_linux_enterprise_server:12:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7.z:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.1:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.1:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:debian:debian_linux:7.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:a:ntp:ntp::p4::::::*			4.2.8

Related information, measures and tools

No	URL	タグ
1	http://aix.software.ibm.com/aix/efixes/security/ntp_advisory5.asc	Third Party Advisory
2	http://aix.software.ibm.com/aix/efixes/security/ntp_advisory5.asc	Third Party Advisory
3	http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170684.html	Third Party Advisory
4	http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170684.html	Third Party Advisory
5	http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html	Third Party Advisory
6	http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html	Third Party Advisory
7	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html	Third Party Advisory
8	http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html	Third Party Advisory
9	http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html	Third Party Advisory
10	http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html	Third Party Advisory
11	http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html	Third Party Advisory
12	http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html	Third Party Advisory
13	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html	Third Party Advisory
14	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html	Third Party Advisory
15	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html	Third Party Advisory
16	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html	Third Party Advisory
17	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html	Third Party Advisory
18	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html	Third Party Advisory
19	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html	Third Party Advisory
20	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html	Third Party Advisory
21	http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html	Third Party Advisory
22	http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html	Third Party Advisory
23	http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html	Third Party Advisory
24	http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html	Third Party Advisory
25	http://rhn.redhat.com/errata/RHSA-2015-1930.html	Third Party Advisory
26	http://rhn.redhat.com/errata/RHSA-2015-1930.html	Third Party Advisory
27	http://seclists.org/bugtraq/2016/Feb/164	Mailing List Third Party Advisory
28	http://seclists.org/bugtraq/2016/Feb/164	Mailing List Third Party Advisory
29	http://support.ntp.org/bin/view/Main/NtpBug2956	Issue Tracking Patch Vendor Advisory
30	http://support.ntp.org/bin/view/Main/NtpBug2956	Issue Tracking Patch Vendor Advisory
31	http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit	Issue Tracking Patch Vendor Advisory
32	http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit	Issue Tracking Patch Vendor Advisory
33	http://www.debian.org/security/2015/dsa-3388	Third Party Advisory
34	http://www.debian.org/security/2015/dsa-3388	Third Party Advisory
35	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	Third Party Advisory
36	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	Third Party Advisory
37	http://www.securityfocus.com/bid/77312	Third Party Advisory VDB Entry
38	http://www.securityfocus.com/bid/77312	Third Party Advisory VDB Entry
39	http://www.securitytracker.com/id/1034670	Third Party Advisory VDB Entry
40	http://www.securitytracker.com/id/1034670	Third Party Advisory VDB Entry
41	http://www.ubuntu.com/usn/USN-2783-1	Third Party Advisory
42	http://www.ubuntu.com/usn/USN-2783-1	Third Party Advisory
43	https://bto.bluecoat.com/security-advisory/sa113	Third Party Advisory
44	https://bto.bluecoat.com/security-advisory/sa113	Third Party Advisory
45	https://bugzilla.redhat.com/show_bug.cgi?id=1271076	Issue Tracking
46	https://bugzilla.redhat.com/show_bug.cgi?id=1271076	Issue Tracking
47	https://ics-cert.us-cert.gov/advisories/ICSA-15-356-01	Third Party Advisory US Government Resource
48	https://ics-cert.us-cert.gov/advisories/ICSA-15-356-01	Third Party Advisory US Government Resource
49	https://security.netapp.com/advisory/ntap-20171004-0001/
50	https://security.netapp.com/advisory/ntap-20171004-0001/
51	https://support.citrix.com/article/CTX220112	Third Party Advisory
52	https://support.citrix.com/article/CTX220112	Third Party Advisory
53	https://www.cs.bu.edu/~goldbe/NTPattack.html	Third Party Advisory
54	https://www.cs.bu.edu/~goldbe/NTPattack.html	Third Party Advisory
55	https://www.freebsd.org/security/advisories/FreeBSD-SA-16:02.ntp.asc	Third Party Advisory
56	https://www.freebsd.org/security/advisories/FreeBSD-SA-16:02.ntp.asc	Third Party Advisory
57	https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099428	Third Party Advisory
58	https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099428	Third Party Advisory
59	https://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html	Third Party Advisory
60	https://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html	Third Party Advisory
61	https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	Third Party Advisory
62	https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	Third Party Advisory
63	https://www-01.ibm.com/support/docview.wss?uid=isg3T1023885	Third Party Advisory
64	https://www-01.ibm.com/support/docview.wss?uid=isg3T1023885	Third Party Advisory
65	https://www-01.ibm.com/support/docview.wss?uid=isg3T1024073	Third Party Advisory
66	https://www-01.ibm.com/support/docview.wss?uid=isg3T1024073	Third Party Advisory
67	https://www-01.ibm.com/support/docview.wss?uid=nas8N1021264	Third Party Advisory
68	https://www-01.ibm.com/support/docview.wss?uid=nas8N1021264	Third Party Advisory
69	https://www-01.ibm.com/support/docview.wss?uid=ssg1S1005821	Third Party Advisory
70	https://www-01.ibm.com/support/docview.wss?uid=ssg1S1005821	Third Party Advisory
71	https://www-01.ibm.com/support/docview.wss?uid=swg21979393	Third Party Advisory
72	https://www-01.ibm.com/support/docview.wss?uid=swg21979393	Third Party Advisory
73	https://www-01.ibm.com/support/docview.wss?uid=swg21980676	Third Party Advisory
74	https://www-01.ibm.com/support/docview.wss?uid=swg21980676	Third Party Advisory
75	https://www-01.ibm.com/support/docview.wss?uid=swg21983501	Third Party Advisory
76	https://www-01.ibm.com/support/docview.wss?uid=swg21983501	Third Party Advisory
77	https://www-01.ibm.com/support/docview.wss?uid=swg21983506	Third Party Advisory
78	https://www-01.ibm.com/support/docview.wss?uid=swg21983506	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-361	時間とステータス	https://cwe.mitre.org/data/definitions/361.html

JVN Vulnerability Information

NTP における時間とステータスに関する脆弱性

Title	NTP における時間とステータスに関する脆弱性
Summary	NTP には、時間とステータスに関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 8, 2015, midnight
Registration Date	Aug. 29, 2017, 2:30 p.m.
Last Update	Aug. 29, 2017, 2:30 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux Desktop 6.0

Red Hat Enterprise Linux Desktop 7.0

Red Hat Enterprise Linux HPC Node 6.0

Red Hat Enterprise Linux HPC Node 7.0

Red Hat Enterprise Linux HPC Node EUS 7.1

Red Hat Enterprise Linux Server 6.0

Red Hat Enterprise Linux Server 7.0

Red Hat Enterprise Linux Server EUS 6.7.z

Red Hat Enterprise Linux Server EUS 7.1

Red Hat Enterprise Linux Workstation 6.0

Red Hat Enterprise Linux Workstation 7.0

NTP Project

NTP 4.2.8p5 未満

Debian

Debian GNU/Linux 7.0

Debian GNU/Linux 8.0

Fedora Project

Fedora 21

Fedora 22

Canonical

Ubuntu 12.04 LTS

Ubuntu 14.04 LTS

Ubuntu 15.04

Ubuntu 15.10

SUSE

SUSE Linux Enterprise Debuginfo 11-SP2

SUSE Linux Enterprise Debuginfo 11-SP3

SUSE Linux Enterprise Debuginfo 11-SP4

SUSE Linux Enterprise Desktop 12

SUSE Linux Enterprise Desktop 12-SP1

SUSE Linux Enterprise Server 10 SP4 LTSS

SUSE Linux Enterprise Server 11-SP2-LTSS

SUSE Linux Enterprise Server 11-SP3-LTSS

SUSE Linux Enterprise Server 11-SP4

SUSE Linux Enterprise Server 12

SUSE Linux Enterprise Server 12-SP1

SUSE Linux Enterprise Software Development Kit 12

SUSE Linux Enterprise Software Development Kit 12-SP1

SUSE Manager 2.1

SUSE Manager Proxy 2.1

SUSE OpenStack Cloud 5

openSUSE project

openSUSE 13.2

openSUSE Leap 42.1

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-5300	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5300
National Vulnerability Database (NVD)
2	CVE-2015-5300	https://nvd.nist.gov/vuln/detail/CVE-2015-5300

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-361	https://cwe.mitre.org/data/definitions/361.html

ベンダー情報

No	Name	URL
Citrix Knowledge Center
1	CTX220112	https://support.citrix.com/article/CTX220112
Debian Security Advisory
2	DSA-3388	https://www.debian.org/security/2015/dsa-3388
Fedora Update Notification
3	FEDORA-2015-77bfbc1bcd	https://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html
4	FEDORA-2015-f5f5ec7b6b	https://lists.fedoraproject.org/pipermail/package-announce/2015-November/170684.html
5	FEDORA-2016-34bc10a2c8	https://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html
FreeBSD Security Advisory
6	FreeBSD-SA-16:02.ntp	https://www.freebsd.org/security/advisories/FreeBSD-SA-16:02.ntp.asc
IBM SECURITY ADVISORY
7	Vulnerability in NTPv4 affects AIX (CVE-2015-5300)	http://aix.software.ibm.com/aix/efixes/security/ntp_advisory5.asc
IBM Security Bulletin
8	MIGR-5099428	https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099428
IBM Support Document
9	1979393	https://www-01.ibm.com/support/docview.wss?uid=swg21979393
10	1980676	https://www-01.ibm.com/support/docview.wss?uid=swg21980676
11	1983501	https://www-01.ibm.com/support/docview.wss?uid=swg21983501
12	1983506	https://www-01.ibm.com/support/docview.wss?uid=swg21983506
13	N1021264	https://www-01.ibm.com/support/docview.wss?uid=nas8N1021264
14	S1005821	https://www-01.ibm.com/support/docview.wss?uid=ssg1S1005821
15	T1023885	https://www-01.ibm.com/support/docview.wss?uid=isg3T1023885
16	T1024073	https://www-01.ibm.com/support/docview.wss?uid=isg3T1024073
opensuse-security-announce
17	openSUSE-SU-2016:1292	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html
18	SUSE-SU-2016:1175	http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html
19	SUSE-SU-2016:1177	http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html
20	SUSE-SU-2016:1247	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html
21	SUSE-SU-2016:1311	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html
22	SUSE-SU-2016:1912	http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
23	SUSE-SU-2016:2094	http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
opensuse-updates
24	openSUSE-SU-2016:1423	http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
Oracle Critical Patch Update
25	Oracle Critical Patch Update Advisory - July 2016	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Oracle Technology Network
26	Oracle Linux Bulletin - October 2015	https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
27	Oracle Solaris Third Party Bulletin - January 2016	https://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
Red Hat Bugzilla
28	Bug 1271076	https://bugzilla.redhat.com/show_bug.cgi?id=1271076
Red Hat Security Advisory
29	RHSA-2015:1930	https://access.redhat.com/errata/RHSA-2015:1930
Security Notice
30	January 2016 NTP-4.2.8p5 Security Vulnerability Announcement (Medium)	http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p5_Securit
31	NTP Bug 2956	http://support.ntp.org/bin/view/Main/NtpBug2956
Symantec Security Advisory
32	SA113	https://www.symantec.com/security-center/network-protection-security-advisories/SA113
Ubuntu Security Notice
33	USN-2783-1	https://usn.ubuntu.com/usn/USN-2783-1/

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-15-356-01	https://ics-cert.us-cert.gov/advisories/ICSA-15-356-01

Change Log

No	Changed Details	Date of change
0	[2017年08月29日] 掲載	Feb. 17, 2018, 10:37 a.m.

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_server:11:sp4::::::
cpe:2.3:o:suse:manager_proxy:2.1:::::::*
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1::::::
cpe:2.3:o:suse:manager:2.1:::::::*
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:::ltss:::*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:::::::*
cpe:2.3:o:suse:linux_enterprise_server:12:sp1::::::
cpe:2.3:o:suse:openstack_cloud:5:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:12:::::::*
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:::ltss:::*
cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1::::::
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:::ltss:::*
cpe:2.3:o:opensuse:leap:42.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.2:::::::*
cpe:2.3:o:suse:suse_linux_enterprise_server:12:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:6.7.z:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.1:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.1:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*