The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC.
CVSS Details
- CVSS 3.1 Base Score: 5.9
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Adminframework | — | Upgrade macOS to the latest versionApply OS X security update 2015-005 | Aug 28, 2015 | Apr 8, 2015 |
| Apple Osx Ntp | — | Upgrade macOS to the latest versionApply OS X security update 2015-005 | Mar 29, 2016 | Apr 8, 2015 |
| Cisco Apic | — | Upgrade to the latest version of Cisco APIC to resolve this vulnerability. | May 11, 2026 | Apr 8, 2015 |
| Cisco Xe | — | Upgrade to the latest version of Cisco IOS XE | Jul 30, 2019 | Apr 8, 2015 |
| Cisco Xr Os | — | Upgrade to the latest version of Cisco IOS-XR to resolve this vulnerability. | May 19, 2021 | Apr 8, 2015 |
| Debian | — | Upgrade ntp | Jul 30, 2024 | Apr 8, 2015 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Nov 7, 2015 |
| Freebsd | — | Upgrade FreeBSDUpgrade ntpUpgrade ntp-devel | Dec 10, 2025 | Apr 7, 2015 |
| Gentoo Linux | — | Upgrade net-misc/ntp. | Oct 30, 2017 | Apr 8, 2015 |
| Hpux | — | Update NTP.NTP-RUN to the latest versionUpdate NTP.NTP-AUX to the latest versionUpdate NTP.INETSVCS2-BOOT to the latest version | Aug 11, 2017 | Apr 8, 2015 |
| Ntp | — | Upgrade to the latest version of NTP | Feb 23, 2023 | Apr 8, 2015 |
| Oracle Solaris | — | Upgrade service/network/ntp to version 4.2.8.2-0.175.2.10.0.5.0 on Solaris 11.2 | May 29, 2017 | Apr 8, 2015 |
| Oracle_linux | — | Upgrade ntp-perlUpgrade ntpUpgrade ntpdateUpgrade sntpUpgrade ntp-doc | Oct 16, 2024 | Apr 8, 2015 |
| Suse | — | Upgrade ntpUpgrade ntp-doc | Dec 18, 2015 | Apr 8, 2015 |
| Ubuntu | — | Upgrade ntp | Nov 8, 2024 | Apr 8, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub