CVE-2015-5194

High

Published: 21/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The log_config_command function in ntp_parser.y in ntpd in NTP before version 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.

Risk Assessment

Attackers can remotely trigger a crash of the NTP server, leading to service unavailability for users. This may affect time synchronization within the organization.

Recommendation

It is recommended to update NTP to version 4.2.7p42 or later to mitigate this vulnerability.

Other vulnerabilities in NTP (Network Time Protocol) daemon (ntpd)

CVE-2014-9295High
Multiple stack-based buffer overflows in ntpd in NTP before version 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet. These issues are related to the crypto_recv function when using the Autokey Authentication feature, the ctl_putdata function, and the configure function.

Original NVD description (English source)

The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.