Published: 07/08/2017 Updated: 17/11/2021

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The ntpd client in NTP 4.x prior to 4.2.8p4 and 4.3.x prior to 4.3.77 allows remote malicious users to cause a denial of service via a number of crafted "KOD" messages.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ntp ntp
ntp ntp 4.2.8
debian debian linux 7.0
debian debian linux 8.0
debian debian linux 9.0
netapp oncommand performance manager -
netapp oncommand unified manager -
netapp clustered data ontap -
netapp data ontap -
redhat enterprise linux desktop 6.0
redhat enterprise linux desktop 7.0
redhat enterprise linux server 6.0
redhat enterprise linux server 7.0
redhat enterprise linux server aus 6.5
redhat enterprise linux server aus 6.6
redhat enterprise linux server aus 7.3
redhat enterprise linux server aus 7.4
redhat enterprise linux server aus 7.6
redhat enterprise linux server aus 7.7
redhat enterprise linux server eus 6.5
redhat enterprise linux server eus 6.6
redhat enterprise linux server eus 6.7
redhat enterprise linux server eus 7.1
redhat enterprise linux server eus 7.3
redhat enterprise linux server eus 7.4
redhat enterprise linux server eus 7.5
redhat enterprise linux server eus 7.6
redhat enterprise linux server eus 7.7
redhat enterprise linux server tus 6.5
redhat enterprise linux server tus 6.6
redhat enterprise linux server tus 7.3
redhat enterprise linux server tus 7.6
redhat enterprise linux server tus 7.7
redhat enterprise linux workstation 6.0
redhat enterprise linux workstation 7.0
mcafee enterprise security manager
citrix xenserver 6.0.2
citrix xenserver 6.2.0
citrix xenserver 6.5
citrix xenserver 7.0

Synopsis Important: ntp security update Type/Severity Security Advisory: Important Topic Updated ntp packages that fix one security issue are now available for RedHat Enterprise Linux 65 and 66 Extended Update SupportRed Hat Product Security has rated this update as having Important securityimpact A Com ...

Several security issues were fixed in NTP ...

Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs: CVE-2015-5146 A flaw was found in the way ntpd processed certain remote configuration packets An attacker could use a specially crafted package to cause ntpd to crash if: ntpd enabled remote configuration The attacker had the ...

It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that would increase the client's polling interval value, and effectively disable synchronization with the server (CVE-2015-7704) It was found that ntpd d ...

It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that would increase the client's polling interval value, and effectively disable synchronization with the server ...

Multiple Cisco products incorporate a version of the ntpd package Versions of this package are affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition or modify the time being advertised by a device acting as a network time protocol (NTP) server On October 21st, 2 ...

Description of Problem Several security issues have been identified within Citrix XenServer These issues could, if exploited, allow an authenticated administrator to perform a denial-of-service attack against the host, even when that administrator has a less-privileged RBAC role (eg read-only)  In addition, the issues could permit an attac ...

CWE-20 https://www.kb.cert.org/vuls/id/718152 https://www.cs.bu.edu/~goldbe/NTPattack.html https://eprint.iacr.org/2015/1020.pdf https://bugzilla.redhat.com/show_bug.cgi?id=1271070 http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_4_2_8p4_Securit http://support.ntp.org/bin/view/Main/NtpBug2901 http://bugs.ntp.org/show_bug.cgi?id=2901 https://security.gentoo.org/glsa/201607-15 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05270839 http://www.securityfocus.com/bid/77280 http://www.securitytracker.com/id/1033951 http://www.debian.org/security/2015/dsa-3388 https://security.netapp.com/advisory/ntap-20171004-0002/https://security.netapp.com/advisory/ntap-20171004-0001/https://support.citrix.com/article/CTX220112 http://rhn.redhat.com/errata/RHSA-2015-2520.html http://rhn.redhat.com/errata/RHSA-2015-1930.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html https://kc.mcafee.com/corporate/index?page=content&id=SB10284 https://www.arista.com/en/support/advisories-notices/security-advisories/1212-security-advisory-0016 https://access.redhat.com/errata/RHSA-2015:2520 https://nvd.nist.gov https://usn.ubuntu.com/2783-1/https://www.kb.cert.org/vuls/id/718152

CVE-2015-7704

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect