CVE-2015-7974: Debian Linux

High severity, CVSS 7.7. EPSS: 5.7% chance of exploitation in the next 30 days.

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Netapp Clustered Data Ontap: affected versions not specified
• Netapp Oncommand Balance: affected versions not specified
• Ntp Ntp: from 4.2.0, before 4.2.8 (fixed in 4.2.8); from 4.3.0, before 4.3.90 (fixed in 4.3.90); version 4.2.8 only
• Siemens Tim 4r-Ie DNP3 Firmware: any version
• Siemens Tim 4r-Ie Firmware: any version

Published 2016-01-26. Last modified 2026-06-17.