Skip to content
Fencer Intel
high 7.5

CVE-2015-5300 json

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 millisec…

published 2017-07-21 9 y ago modified 2026-06-17 4 mo ago also EUVD-2015-5276

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
9.1%
EPSS 9.1% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

Patch / fix

  • ntp Debian 11 1:4.2.8p4+dfsg-2

debian advisories DEBIAN-CVE-2015-5300

  • ntp Ubuntu 14.04 LTS 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5

ubuntu advisories UBUNTU-CVE-2015-5300

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ntp RHEL 6 4.2.6p5-5.el6_7.2
  • ntp RHEL 7 4.2.6p5-19.el7_1.3
  • ntp RHEL 7 4.2.6p5-19.ael7b_1.3
  • sntp RHEL 7 4.2.6p5-19.el7_1.3
  • sntp RHEL 7 4.2.6p5-19.ael7b_1.3
  • ntpdate RHEL 6 4.2.6p5-5.el6_7.2
  • ntpdate RHEL 7 4.2.6p5-19.el7_1.3
  • ntpdate RHEL 7 4.2.6p5-19.ael7b_1.3

red hat advisories RHSA-2015:1930

  • ntp SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLES 11 SP2-LTSS +3 more 4.2.8p6-41.1
  • ntp SLES for SAP 12, SLES 12, SLED 12 4.2.8p6-46.5.2
  • yast2-ntp-client SLES for SAP 12, SLES 12, SLED 12 +1 more 3.1.12.4-8.2
  • ntp SLES 12 SP1, SLES 11 SP4, SLED 12 SP1 +2 more 4.2.8p6-8.2
  • yast2-ntp-client SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 3.1.22-6.2
  • yast2-ntp-client SLES 11 SP2-LTSS 2.17.14.1-1.12.1

suse advisories SUSE-SU-2016:1311-1SUSE-SU-2016:1247-1SUSE-SU-2016:1175-1SUSE-SU-2016:1177-1

  • ntp openSUSE Tumbleweed 4.2.8p9-1.1

opensuse advisories openSUSE-SU-2024:10181-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-5300 updated cvss 4.3

ntp: MITM attacker can force ntpd to make a step larger than the panic threshold

  • Red Hat Enterprise Linux 5 ntp
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client (v. 7) ntp 4.2.6p5-19.el7_1.3, ntpdate 4.2.6p5-19.el7_1.3 Red Hat Enterprise Linux Client Optional (v. 7) sntp 4.2.6p5-19.el7_1.3, ntp-perl 4.2.6p5-19.el7_1.3 Red Hat Enterprise Linux ComputeNode (v. 7) ntp 4.2.6p5-19.el7_1.3, ntpdate 4.2.6p5-19.el7_1.3 Red Hat Enterprise Linux ComputeNode Optional (v. 7) sntp 4.2.6p5-19.el7_1.3, ntp-perl 4.2.6p5-19.el7_1.3 Red Hat Enterprise Linux Desktop (v. 6) ntp 4.2.6p5-5.el6_7.2, ntpdate 4.2.6p5-5.el6_7.2 Red Hat Enterprise Linux Desktop Optional (v. 6) ntp-perl 4.2.6p5-5.el6_7.2
    +10 more products
    Red Hat Enterprise Linux HPC Node (v. 6) ntp 4.2.6p5-5.el6_7.2, ntpdate 4.2.6p5-5.el6_7.2 Red Hat Enterprise Linux HPC Node Optional (v. 6) ntp-perl 4.2.6p5-5.el6_7.2 Red Hat Enterprise Linux Server (v. 6) ntp 4.2.6p5-5.el6_7.2, ntpdate 4.2.6p5-5.el6_7.2 Red Hat Enterprise Linux Server (v. 7) ntp 4.2.6p5-19.el7_1.3, ntp 4.2.6p5-19.ael7b_1.3, ntpdate 4.2.6p5-19.el7_1.3, ntpdate 4.2.6p5-19.ael7b_1.3 Red Hat Enterprise Linux Server Optional (v. 6) ntp-perl 4.2.6p5-5.el6_7.2 Red Hat Enterprise Linux Server Optional (v. 7) sntp 4.2.6p5-19.el7_1.3, sntp 4.2.6p5-19.ael7b_1.3, ntp-perl 4.2.6p5-19.el7_1.3, ntp-perl 4.2.6p5-19.ael7b_1.3 Red Hat Enterprise Linux Workstation (v. 6) ntp 4.2.6p5-5.el6_7.2, ntpdate 4.2.6p5-5.el6_7.2 Red Hat Enterprise Linux Workstation (v. 7) ntp 4.2.6p5-19.el7_1.3, ntpdate 4.2.6p5-19.el7_1.3 Red Hat Enterprise Linux Workstation Optional (v. 6) ntp-perl 4.2.6p5-5.el6_7.2 Red Hat Enterprise Linux Workstation Optional (v. 7) sntp 4.2.6p5-19.el7_1.3, ntp-perl 4.2.6p5-19.el7_1.3
    fixed: vendor fix RHSA-2015:1930

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-15-356-01 updated cvss 3.7

Siemens RUGGEDCOM ROX-based Devices NTP Vulnerabilities

  • Siemens ROX II <2.9.0 Siemens RUGGEDCOM ROX I
    affected: mitigation “Update to the latest version. (http://www.siemens.com/automation/support-request)”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

9.13% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.