VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 21, 2017· Updated May 13, 2026

CVE-2015-5300

CVE-2015-5300

Description

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

NTP before 4.2.8p5 has a flaw in panic_gate re-enabling that lets remote attackers set arbitrary time or cause denial of service.

Vulnerability

The panic_gate check in NTP before version 4.2.8p5 is only re-enabled after the first change to the system clock that exceeds 128 milliseconds by default. When the NTP daemon is started with the -g option, this allows remote attackers to set the system clock to an arbitrary time. Without the -g option, an attacker can alter the time by up to 900 seconds by responding to an unspecified number of requests from trusted sources, leveraging a resulting denial of service (abort and restart) [1][3].

Exploitation

An attacker with network access to the NTP service (UDP port 123) can send specially crafted responses. When the daemon is started with -g, the attacker can set the time to any value. Without -g, the attacker must respond to multiple requests from trusted sources to shift the clock up to 900 seconds, eventually triggering an assertion failure and daemon crash/restart [2][4]. No authentication is required, but the victim must be configured to query the attacker-controlled NTP server or the attacker must be able to inject packets into the network path.

Impact

Successful exploitation results in denial of service (abort and restart of the NTP daemon) and, when using the -g option, arbitrary time manipulation. This can disrupt time-sensitive applications, break certificate validation, and hinder log correlation. The attacker does not gain code execution or elevated privileges but can significantly impair system availability and reliability [1][3].

Mitigation

The vulnerability is fixed in NTP 4.2.8p5 released January 2016 [3]. Users should upgrade to NTP 4.2.8p5 or later. Red Hat Enterprise Linux 6 and 7 received updated packages (ntp-4.2.6p5-19.el7_1.3 and ntp-4.2.6p5-5.el6_7.2) as part of RHSA-2015:1930 [1]. Siemens RUGGEDCOM ROX devices were also patched (versions 2.9.0 and later) [4]. If upgrading is not possible, avoid using the -g option and restrict NTP associations to trusted servers.

References
  1. http://rhn.redhat.com/errata/RHSA-2015-1930.html
  2. IBM Flex System Manager (FSM) is affected by multiple ntp vulnerabilities
  3. Security
  4. Siemens RUGGEDCOM ROX-based Devices NTP Vulnerabilities | CISA

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

63

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

39

News mentions

0

No linked articles in our index yet.