What’s Vulnerable › Vulnerabilities
CVE-2015-5300
- Severity: high (CVSS 7.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 9.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2017-07-21 · updated 2026-06-17
- Weakness: CWE-361
Description
The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 15.04, 15.10
- Debian Linux: 7.0, 8.0
- Fedoraproject Fedora: 21, 22
- NTP: through 4.2.8
- openSUSE Leap: 42.1
- Opensuse: 13.2
- RedHat Enterprise Linux Desktop: 6.0, 7.0
- RedHat Enterprise Linux Hpc Node: 6.0, 7.0
- RedHat Enterprise Linux Hpc Node Eus: 7.1
- RedHat Enterprise Linux Server: 6.0, 7.0
- RedHat Enterprise Linux Server Eus: 6.7.z, 7.1
- RedHat Enterprise Linux Workstation: 6.0, 7.0
- SUSE Linux Enterprise Debuginfo: 11-sp2, 11-sp3, 11-sp4
- SUSE Linux Enterprise Server 15 SP1: 12, 12-sp1
- SUSE Linux Enterprise Server: 10-sp4, 11-sp2, 11-sp3, 11-sp4, 12-sp1
- SUSE Linux Enterprise Software Development Kit: 12, 12-sp1
- SUSE Manager: 2.1
- SUSE Manager Proxy: 2.1
- SUSE Openstack Cloud: 5
- SUSE Linux Enterprise: 12
References
- http://aix.software.ibm.com/aix/efixes/security/ntp_advisory5.asc
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170684.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
Get alerted when CVE-2015-5300 or the next vulnerability affects your stack