Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2015-7977

Published: 30/01/2017 Updated: 01/02/2022
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Subscribe to Ntp

Vulnerability Summary

ntpd in NTP prior to 4.2.8p6 and 4.3.x prior to 4.3.90 allows remote malicious users to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

ntp ntp

ntp ntp 4.2.8

oracle linux 6

siemens tim_4r-ie_firmware

siemens tim_4r-ie_dnp3_firmware -

netapp clustered data ontap -

netapp oncommand balance -

freebsd freebsd 9.3

freebsd freebsd 10.1

freebsd freebsd 10.2

fedoraproject fedora 22

fedoraproject fedora 23

debian debian linux 8.0

debian debian linux 9.0

canonical ubuntu linux 12.04

canonical ubuntu linux 14.04

canonical ubuntu linux 16.04

Vendor Advisories

Red Hat: Moderate: ntp security and bug fix update
Synopsis Moderate: ntp security and bug fix update Type/Severity Security Advisory: Moderate Topic An update for ntp is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score ...
Ubuntu Security Notice: ntp vulnerabilities
Several security issues were fixed in NTP ...
Amazon Linux AMI: ALAS-2016-649
It was discovered that ntpd as a client did not correctly check the originate timestamp in received packets A remote attacker could use this flaw to send a crafted packet to an ntpd client that would effectively disable synchronization with the server, or push arbitrary offset/delay measurements to modify the time on the client (CVE-2015-8138) A ...
Red Hat: CVE-2015-7977
A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries A remote attacker could potentially use this flaw to crash ntpd ...
Cisco: Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: January 2016
Multiple Cisco products incorporate a version of the Network Time Protocol daemon (ntpd) package Versions of this package are affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition or modify the time being advertised by a device acting as a Network Time Protocol (N ...

References

CWE-476https://www.kb.cert.org/vuls/id/718152https://security.gentoo.org/glsa/201607-15https://bto.bluecoat.com/security-advisory/sa113http://www.ubuntu.com/usn/USN-3096-1http://www.securitytracker.com/id/1034782http://www.securityfocus.com/bid/81815http://www.debian.org/security/2016/dsa-3629http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpdhttp://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Securityhttp://support.ntp.org/bin/view/Main/NtpBug2939http://rhn.redhat.com/errata/RHSA-2016-2583.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0780.htmlhttp://lists.opensuse.org/opensuse-updates/2016-05/msg00114.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.htmlhttps://security.netapp.com/advisory/ntap-20171031-0001/https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.aschttp://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttps://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdfhttps://us-cert.cisa.gov/ics/advisories/icsa-21-103-11https://access.redhat.com/errata/RHSA-2016:2583https://usn.ubuntu.com/3096-1/https://nvd.nist.govhttps://www.kb.cert.org/vuls/id/718152
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
injectionCVE-2024-30983CVE-2023-4235CVE-2024-21338privilegeencryptionCVE-2023-4232CVE-2024-31497CVE-2024-32341
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook