CVE-2015-8138

Public on 2016-02-09
Modified on 2016-10-18
Description
It was discovered that ntpd as a client did not correctly check the originate timestamp in received packets. A remote attacker could use this flaw to send a crafted packet to an ntpd client that would effectively disable synchronization with the server, or push arbitrary offset/delay measurements to modify the time on the client.
Severity
Important severity
Important
CVSS v3 Base Score
6.4
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 ntp 2016-02-09 ALAS-2016-649 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv2 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P
NVD CVSSv2 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
NVD CVSSv3 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N