Is CVE-2015-8138 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-8138 being exploited in the wild.

How severe is CVE-2015-8138?

Medium severity, with a CVSS score of 5.3, published 30 January 2017.

Which products and versions are affected?

NTP Project Ntpd 4.2.8 before 4.2.8p6, 4.3.x before 4.3.90.

Is there a fix for CVE-2015-8138?

A patch was published on 2016-01-19: NTP 4.2.8p6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2015-8138 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2015-8138?

Check whether you run NTP Project Ntpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-8138: NTP Project ntpd origin timestamp validation bypass

CVE-2015-8138 · Severity: medium · CVSS 5.3 · Published 2017-01-30

The Network Time Protocol (NTP) service, which synchronizes clocks across computer networks, contains a security flaw in how it validates incoming packets. An attacker can send a specially crafted packet to bypass security checks that ensure time updates are coming from a legitimate source. This could allow an unauthorized party to potentially influence or disrupt the time synchronization of affected systems.

Technologies: NTP Project Ntpd. Vendors: NTP Project.

Quick answers

Is CVE-2015-8138 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-8138 being exploited in the wild.
How severe is CVE-2015-8138?: Medium severity, with a CVSS score of 5.3, published 30 January 2017.
Which products and versions are affected?: NTP Project Ntpd 4.2.8 before 4.2.8p6, 4.3.x before 4.3.90.
Is there a fix for CVE-2015-8138?: A patch was published on 2016-01-19: NTP 4.2.8p6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-8138 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2015-8138?: Check whether you run NTP Project Ntpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the Network Time Protocol (NTP) daemon (ntpd) involves improper input validation of the origin timestamp field. Remote, unauthenticated attackers can bypass the origin timestamp validation mechanism by sending a packet where the origin timestamp is set to zero. This bypass allows an attacker to potentially inject unauthorized time data or interfere with the synchronization process. The issue is resolved in NTP versions 4.2.8p6 and 4.3.90.

Affected products

NTP Project ntpd 4.2.8 before 4.2.8p6, 4.3.x before 4.3.90

Timeline

2016-01-19: patched: NTP 4.2.8p6 released
2017-01-30: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.