ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: denial of service by trigerring rate limiting on NTP server (CVE-2015-7705)

  - The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a     denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1     requests, as exploited in the wild in December 2013. (CVE-2013-5211)

  - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a     GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
    (CVE-2014-5209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: denial of service by trigerring rate limiting on NTP server (CVE-2015-7705)

  - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a     GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
    (CVE-2014-5209)

  - ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with     knowledge of the configuration password and access to a computer entrusted to perform remote configuration     to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.
    (CVE-2015-5146)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - NTP through 4.2.8p12 has a NULL Pointer     Dereference.(CVE-2019-8936)

  - ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets     before updating the 'received' timestamp, which allows     remote attackers to cause a denial of service     (disruption) by sending a packet with a zero-origin     timestamp causing the association to reset and setting     the contents of the packet as the most recent     timestamp. This issue is a result of an incomplete fix     for CVE-2015-7704.(CVE-2018-7184)

  - Buffer overflow in the decodearr function in ntpq in     ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to     execute arbitrary code by leveraging an ntpq query and     sending a response with a crafted array.(CVE-2018-7183)

  - NTP before 4.2.8p6 and 4.3.x before 4.3.90, when     configured in broadcast mode, allows man-in-the-middle     attackers to conduct replay attacks by sniffing the     network.(CVE-2015-7973)

  - ntpd in ntp before 4.2.8p3 with remote configuration     enabled allows remote authenticated users with     knowledge of the configuration password and access to a     computer entrusted to perform remote configuration to     cause a denial of service (service crash) via a NULL     byte in a crafted configuration directive     packet.(CVE-2015-5146)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets     before updating the 'received' timestamp, which allows     remote attackers to cause a denial of service     (disruption) by sending a packet with a zero-origin     timestamp causing the association to reset and setting     the contents of the packet as the most recent     timestamp. This issue is a result of an incomplete fix     for CVE-2015-7704.(CVE-2018-7184)

  - Buffer overflow in the decodearr function in ntpq in     ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to     execute arbitrary code by leveraging an ntpq query and     sending a response with a crafted array.(CVE-2018-7183)

  - NTP before 4.2.8p6 and 4.3.x before 4.3.90, when     configured in broadcast mode, allows man-in-the-middle     attackers to conduct replay attacks by sniffing the     network.(CVE-2015-7973)

  - ntpd in ntp before 4.2.8p3 with remote configuration     enabled allows remote authenticated users with     knowledge of the configuration password and access to a     computer entrusted to perform remote configuration to     cause a denial of service (service crash) via a NULL     byte in a crafted configuration directive     packet.(CVE-2015-5146)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - NTP before 4.2.8p6 and 4.3.x before 4.3.90, when     configured in broadcast mode, allows man-in-the-middle     attackers to conduct replay attacks by sniffing the     network.(CVE-2015-7973)

  - NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows     remote attackers to cause a denial of service (prevent     subsequent authentication) by leveraging knowledge of     the controlkey or requestkey and sending a crafted     packet to ntpd, which changes the value of trustedkey,     controlkey, or requestkey. NOTE: this vulnerability     exists because of a CVE-2016-2516     regression.(CVE-2016-2517)

  - ntpd in ntp before 4.2.8p3 with remote configuration     enabled allows remote authenticated users with     knowledge of the configuration password and access to a     computer entrusted to perform remote configuration to     cause a denial of service (service crash) via a NULL     byte in a crafted configuration directive     packet.(CVE-2015-5146)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows     remote attackers to cause a denial of service (prevent     subsequent authentication) by leveraging knowledge of     the controlkey or requestkey and sending a crafted     packet to ntpd, which changes the value of trustedkey,     controlkey, or requestkey. NOTE: this vulnerability     exists because of a CVE-2016-2516     regression.(CVE-2016-2517)

  - NTP before 4.2.8p6 and 4.3.x before 4.3.90, when     configured in broadcast mode, allows man-in-the-middle     attackers to conduct replay attacks by sniffing the     network.(CVE-2015-7973)

  - ntpd in ntp before 4.2.8p3 with remote configuration     enabled allows remote authenticated users with     knowledge of the configuration password and access to a     computer entrusted to perform remote configuration to     cause a denial of service (service crash) via a NULL     byte in a crafted configuration directive     packet.(CVE-2015-5146)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - NTP before 4.2.8p6 and 4.3.x before 4.3.90, when     configured in broadcast mode, allows man-in-the-middle     attackers to conduct replay attacks by sniffing the     network.(CVE-2015-7973)

  - ntpd in ntp before 4.2.8p3 with remote configuration     enabled allows remote authenticated users with     knowledge of the configuration password and access to a     computer entrusted to perform remote configuration to     cause a denial of service (service crash) via a NULL     byte in a crafted configuration directive     packet.(CVE-2015-5146)

  - Buffer overflow in the decodearr function in ntpq in     ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to     execute arbitrary code by leveraging an ntpq query and     sending a response with a crafted array.(CVE-2018-7183)

  - ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets     before updating the 'received' timestamp, which allows     remote attackers to cause a denial of service     (disruption) by sending a packet with a zero-origin     timestamp causing the association to reset and setting     the contents of the packet as the most recent     timestamp. This issue is a result of an incomplete fix     for CVE-2015-7704.(CVE-2018-7184)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of the remote NTP server is 3.x or 4.x prior to 4.2.8p3.
It is, therefore, affected by the following vulnerability :

  - ntpd in ntp before 4.2.8p3 with remote configuration enabled     allows remote authenticated users with knowledge of the     configuration password and access to a computer entrusted to     perform remote configuration to cause a denial of service     (service crash) via a NULL byte in a crafted configuration     directive packet. (CVE-2015-1798)

ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet. (CVE-2015-5146)

An attacker can use a specially crafted package to cause ntpd to become unresponsive when all of the following conditions are met :

The ntpd configuration has enabled remote configuration.

The attacker has knowledge of the configuration password.

The attacker has access to a computer entrusted to perform remote configurations.

Impact

For BIG-IP systems using a default network time protocol (NTP) configuration, there is no impact. However, BIG-IP systems with an NTP configuration that is customized in line with the requirements of the advisory may be vulnerable.

Security fix for CVE-2015-7704, CVE-2015-5300, CVE-2015-7692, CVE-2015-7871, CVE-2015-7702, CVE-2015-7691, CVE-2015-7852, CVE-2015-7701 ---- Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs :

  - CVE-2015-5146     A flaw was found in the way ntpd processed certain     remote configuration packets. An attacker could use a     specially crafted package to cause ntpd to crash if :

    - ntpd enabled remote configuration
    - The attacker had the knowledge of the configuration       password

    - The attacker had access to a computer entrusted to       perform remote configuration

      Note that remote configuration is disabled by default       in NTP.

  - CVE-2015-5194     It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands.

  - CVE-2015-5195     It was found that ntpd exits with a segmentation fault     when a statistics type that was not enabled during     compilation (e.g. timingstats) is referenced by the     statistics or filegen configuration command.

  - CVE-2015-5219     It was discovered that sntp program would hang in an     infinite loop when a crafted NTP packet was received,     related to the conversion of the precision value in the     packet to double.

  - CVE-2015-5300     It was found that ntpd did not correctly implement the
    -g option :

  Normally, ntpd exits with a message to the system log if the offset   exceeds the panic threshold, which is 1000 s by default. This option   allows the time to be set to any value without restriction; however,   this can happen only once. If the threshold is exceeded after that,   ntpd will exit with a message to the system log. This option can be   used with the -q and -x options.

  ntpd could actually step the clock multiple times by more than the   panic threshold if its clock discipline doesn't have enough time to   reach the sync state and stay there for at least one update. If a   man-in-the-middle attacker can control the NTP traffic since ntpd   was started (or maybe up to 15-30 minutes after that), they can   prevent the client from reaching the sync state and force it to step   its clock by any amount any number of times, which can be used by   attackers to expire certificates, etc.

  This is contrary to what the documentation says. Normally, the   assumption is that an MITM attacker can step the clock more than the   panic threshold only once when ntpd starts and to make a larger   adjustment the attacker has to divide it into multiple smaller   steps, each taking 15 minutes, which is slow.

  - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702     It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in ntp_crypto.c, where a packet with particular     autokey operations that contained malicious data was not     always being completely validated. Receipt of these     packets can cause ntpd to crash.

  - CVE-2015-7701     A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd is configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory.

  - CVE-2015-7703     Miroslav Lichvar of Red Hat found that the :config     command can be used to set the pidfile and driftfile     paths without any restrictions. A remote attacker could     use this flaw to overwrite a file on the file system     with a file containing the pid of the ntpd process     (immediately) or the current estimated drift of the     system clock (in hourly intervals). For example :

  ntpq -c ':config pidfile /tmp/ntp.pid'ntpq -c ':config driftfile   /tmp/ntp.drift'

  In Debian ntpd is configured to drop root privileges, which limits   the impact of this issue.

  - CVE-2015-7704     If ntpd as an NTP client receives a Kiss-of-Death (KoD)     packet from the server to reduce its polling rate, it     doesn't check if the originate timestamp in the reply     matches the transmit timestamp from its request. An     off-path attacker can send a crafted KoD packet to the     client, which will increase the client's polling     interval to a large value and effectively disable     synchronization with the server.

  - CVE-2015-7850     An exploitable denial of service vulnerability exists in     the remote configuration functionality of the Network     Time Protocol. A specially crafted configuration file     could cause an endless loop resulting in a denial of     service. An attacker could provide a malicious     configuration file to trigger this vulnerability.

  - CVE-2015-7852     A potential off by one vulnerability exists in the     cookedprint functionality of ntpq. A specially crafted     buffer could cause a buffer overflow potentially     resulting in null byte being written out of bounds.

  - CVE-2015-7855     It was found that NTP's decodenetnum() would abort with     an assertion failure when processing a mode 6 or mode 7     packet containing an unusually long data value where a     network address was expected. This could allow an     authenticated attacker to crash ntpd.

  - CVE-2015-7871     An error handling logic error exists within ntpd that     manifests due to improper error condition handling     associated with certain crypto-NAK packets. An     unauthenticated, off-path attacker can force ntpd     processes on targeted servers to peer with time sources     of the attacker's choosing by transmitting symmetric     active crypto-NAK packets to ntpd. This attack bypasses     the authentication typically required to establish a     peer association and allows an attacker to make     arbitrary changes to system time.

Several security issues where found in ntp :

CVE-2015-5146

A flaw was found in the way ntpd processed certain remote configuration packets. An attacker could use a specially crafted package to cause ntpd to crash if :

  - ntpd enabled remote configuration

  - The attacker had the knowledge of the configuration     password

  - The attacker had access to a computer entrusted to     perform remote configuration

    Note that remote configuration is disabled by default in     NTP. 

CVE-2015-5194

It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.

CVE-2015-5195

It was found that ntpd exits with a segmentation fault when a statistics type that was not enabled during compilation (e.g.
timingstats) is referenced by the statistics or filegen configuration command

CVE-2015-5219

It was discovered that sntp program would hang in an infinite loop when a crafted NTP packet was received, related to the conversion of the precision value in the packet to double.

CVE-2015-5300

It was found that ntpd did not correctly implement the -g option:
Normally, ntpd exits with a message to the system log if the offset exceeds the panic threshold, which is 1000 s by default. This option allows the time to be set to any value without restriction; however, this can happen only once. If the threshold is exceeded after that, ntpd will exit with a message to the system log. This option can be used with the -q and -x options. ntpd could actually step the clock multiple times by more than the panic threshold if its clock discipline doesn't have enough time to reach the sync state and stay there for at least one update. If a man-in-the-middle attacker can control the NTP traffic since ntpd was started (or maybe up to 15-30 minutes after that), they can prevent the client from reaching the sync state and force it to step its clock by any amount any number of times, which can be used by attackers to expire certificates, etc.
This is contrary to what the documentation says. Normally, the assumption is that an MITM attacker can step the clock more than the panic threshold only once when ntpd starts and to make a larger adjustment the attacker has to divide it into multiple smaller steps, each taking 15 minutes, which is slow.

CVE-2015-7691, CVE-2015-7692, CVE-2015-7702

It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in ntp_crypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. Receipt of these packets can cause ntpd to crash.

CVE-2015-7701

A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd is configured to use autokey authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack, cause it to run out of memory.

CVE-2015-7703

Miroslav Lichv&aacute;r of Red Hat found that the :config command can be used to set the pidfile and driftfile paths without any restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock (in hourly intervals). For example: ntpq -c ':config pidfile /tmp/ntp.pid' ntpq -c ':config driftfile /tmp/ntp.drift' In Debian ntpd is configured to drop root privileges, which limits the impact of this issue.

CVE-2015-7704

When ntpd as an NTP client receives a Kiss-of-Death (KoD) packet from the server to reduce its polling rate, it doesn't check if the originate timestamp in the reply matches the transmit timestamp from its request. An off-path attacker can send a crafted KoD packet to the client, which will increase the client's polling interval to a large value and effectively disable synchronization with the server.

CVE-2015-7850

An exploitable denial of service vulnerability exists in the remote configuration functionality of the Network Time Protocol. A specially crafted configuration file could cause an endless loop resulting in a denial of service. An attacker could provide a the malicious configuration file to trigger this vulnerability.

CVE-2015-7851

A potential path traversal vulnerability exists in the config file saving of ntpd on VMS. A specially crafted path could cause a path traversal potentially resulting in files being overwritten. An attacker could provide a malicious path to trigger this vulnerability.

This issue does not affect Debian.

CVE-2015-7852

A potential off by one vulnerability exists in the cookedprint functionality of ntpq. A specially crafted buffer could cause a buffer overflow potentially resulting in null byte being written out of bounds.

CVE-2015-7855

It was found that NTP's decodenetnum() would abort with an assertion failure when processing a mode 6 or mode 7 packet containing an unusually long data value where a network address was expected. This could allow an authenticated attacker to crash ntpd.

CVE-2015-7871

An error handling logic error exists within ntpd that manifests due to improper error condition handling associated with certain crypto-NAK packets. An unauthenticated, off&shy;-path attacker can force ntpd processes on targeted servers to peer with time sources of the attacker's choosing by transmitting symmetric active crypto&shy;-NAK packets to ntpd. This attack bypasses the authentication typically required to establish a peer association and allows an attacker to make arbitrary changes to system time.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2783-1 advisory.

    Aleksis Kauppinen discovered that NTP incorrectly handled certain remote config packets. In a non-default     configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash,     resulting in a denial of service. (CVE-2015-5146)

    Miroslav Lichvar discovered that NTP incorrectly handled logconfig directives. In a non-default     configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash,     resulting in a denial of service. (CVE-2015-5194)

    Miroslav Lichvar discovered that NTP incorrectly handled certain statistics types. In a non-default     configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash,     resulting in a denial of service. (CVE-2015-5195)

    Miroslav Lichvar discovered that NTP incorrectly handled certain file paths. In a non-default     configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash,     resulting in a denial of service, or overwrite certain files. (CVE-2015-5196, CVE-2015-7703)

    Miroslav Lichvar discovered that NTP incorrectly handled certain packets. A remote attacker could possibly     use this issue to cause NTP to hang, resulting in a denial of service. (CVE-2015-5219)

    Aanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP incorrectly handled restarting     after hitting a panic threshold. A remote attacker could possibly use this issue to alter the system time     on clients. (CVE-2015-5300)

    It was discovered that NTP incorrectly handled autokey data packets. A remote attacker could possibly use     this issue to cause NTP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)

    It was discovered that NTP incorrectly handled memory when processing certain autokey messages. A remote     attacker could possibly use this issue to cause NTP to consume memory, resulting in a denial of service.
    (CVE-2015-7701)

    Aanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP incorrectly handled rate     limiting. A remote attacker could possibly use this issue to cause clients to stop updating their clock.
    (CVE-2015-7704, CVE-2015-7705)

    Yves Younan discovered that NTP incorrectly handled logfile and keyfile directives. In a non-default     configuration, a remote authenticated attacker could possibly use this issue to cause NTP to enter a loop,     resulting in a denial of service. (CVE-2015-7850)

    Yves Younan and Aleksander Nikolich discovered that NTP incorrectly handled ascii conversion. A remote     attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2015-7852)

    Yves Younan discovered that NTP incorrectly handled reference clock memory. A malicious refclock could     possibly use this issue to cause NTP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-7853)

    John D Doug Birdwell discovered that NTP incorrectly handled decoding certain bogus values. An attacker     could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2015-7855)

    Stephen Gray discovered that NTP incorrectly handled symmetric association authentication. A remote     attacker could use this issue to possibly bypass authentication and alter the system clock.
    (CVE-2015-7871)

    In the default installation, attackers would be isolated by the NTP AppArmor profile.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201509-01 (NTP: Multiple vulnerablities)

    Multiple vulnerabilities have been discovered in NTP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

As discussed upstream, a flaw was found in the way ntpd processed certain remote configuration packets. Note that remote configuration is disabled by default in NTP. (CVE-2015-5146)

It was found that the :config command can be used to set the pidfile and driftfile paths without any restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock (in hourly intervals).
(CVE-2015-7703)

It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.
(CVE-2015-5194)

It was found that ntpd exits with a segmentation fault when a statistics type that was not enabled during compilation (e.g.
timingstats) is referenced by the statistics or filegen configuration command. (CVE-2015-5195)

It was discovered that sntp would hang in an infinite loop when a crafted NTP packet was received, related to the conversion of the precision value in the packet to double. (CVE-2015-5219)

A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server. (CVE-2015-3405)

New ntp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue.

ID	Name	Product	Family	Severity
198541	RHEL 6 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198521	RHEL 7 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
135619	EulerOS Virtualization 3.0.2.2 : ntp (EulerOS-SA-2020-1457)	Nessus	Huawei Local Security Checks	critical
134499	EulerOS Virtualization for ARM 64 3.0.2.0 : ntp (EulerOS-SA-2020-1210)	Nessus	Huawei Local Security Checks	critical
132172	EulerOS 2.0 SP3 : ntp (EulerOS-SA-2019-2637)	Nessus	Huawei Local Security Checks	medium
131600	EulerOS 2.0 SP2 : ntp (EulerOS-SA-2019-2446)	Nessus	Huawei Local Security Checks	medium
130677	EulerOS 2.0 SP5 : ntp (EulerOS-SA-2019-2215)	Nessus	Huawei Local Security Checks	critical
121310	Network Time Protocol Daemon (ntpd) 3.x / 4.x < 4.2.8p3 Denial Of Service Vulnerability	Nessus	Misc.	medium
105510	F5 Networks BIG-IP : NTP vulnerability (K17114)	Nessus	F5 Networks Local Security Checks	medium
89288	Fedora 21 : ntp-4.2.6p5-34.fc21 (2015-77bfbc1bcd)	Nessus	Fedora Local Security Checks	critical
86682	Debian DSA-3388-1 : ntp - security update	Nessus	Debian Local Security Checks	critical
86640	Debian DLA-335-1 : ntp security update	Nessus	Debian Local Security Checks	critical
86630	Ubuntu 14.04 LTS : NTP vulnerabilities (USN-2783-1)	Nessus	Ubuntu Local Security Checks	critical
86331	Fedora 22 : ntp-4.2.6p5-33.fc22 (2015-14212)	Nessus	Fedora Local Security Checks	high
86132	GLSA-201509-01 : NTP: Multiple vulnerablities	Nessus	Gentoo Local Security Checks	medium
86027	Fedora 23 : ntp-4.2.6p5-33.fc23 (2015-14213)	Nessus	Fedora Local Security Checks	high
85751	Amazon Linux AMI : ntp (ALAS-2015-593)	Nessus	Amazon Linux Local Security Checks	high
84590	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : ntp (SSA:2015-188-03)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2015-5146

medium

Tenable Plugins

critical

critical

critical

critical

medium

medium

critical

medium

medium

critical

critical

critical

critical

high

medium

high

high

medium