6.2 Medium
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
ADJACENT_NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:A/AC:M/Au:N/C:N/I:P/A:P
0.008 Low
EPSS
Percentile
79.3%
The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer.
(
CVE-2015-1799
)
Impact
There is no impact for BIG-IP systems using a default NTP configuration. However, BIG-IP systems with an NTP configuration customized to use symmetric authentication in line with the requirements of the advisory may be vulnerable.