Vulnerability Details CVE-2015-7705
The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.365
EPSS Ranking 96.9%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00093.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
- http://packetstormsecurity.com/files/134137/Slackware-Security-Advisory-ntp-Updates.html
- http://support.ntp.org/bin/view/Main/NtpBug2901
- http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_4_2_8p4_Securit
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-ntp
- http://www.securityfocus.com/archive/1/536737/100/0/threaded
- http://www.securityfocus.com/archive/1/536796/100/0/threaded
- http://www.securityfocus.com/archive/1/archive/1/536737/100/100/threaded
- http://www.securityfocus.com/archive/1/archive/1/536796/100/100/threaded
- http://www.securityfocus.com/bid/77284
- http://www.securitytracker.com/id/1033951
- http://www.ubuntu.com/usn/USN-2783-1
- https://bto.bluecoat.com/security-advisory/sa103
- https://bugzilla.redhat.com/show_bug.cgi?id=1274184
- https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
- https://eprint.iacr.org/2015/1020.pdf
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05270839
- https://security.gentoo.org/glsa/201607-15
- https://security.netapp.com/advisory/ntap-20171004-0001/
- https://support.citrix.com/article/CTX220112
- https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
- https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11
- https://www.arista.com/en/support/advisories-notices/security-advisories/1212-security-advisory-0016
- https://www.cs.bu.edu/~goldbe/NTPattack.html
- https://www.kb.cert.org/vuls/id/718152
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00093.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
- http://packetstormsecurity.com/files/134137/Slackware-Security-Advisory-ntp-Updates.html
- http://support.ntp.org/bin/view/Main/NtpBug2901
- http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_4_2_8p4_Securit
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-ntp
- http://www.securityfocus.com/archive/1/536737/100/0/threaded
- http://www.securityfocus.com/archive/1/536796/100/0/threaded
- http://www.securityfocus.com/archive/1/archive/1/536737/100/100/threaded
- http://www.securityfocus.com/archive/1/archive/1/536796/100/100/threaded
- http://www.securityfocus.com/bid/77284
- http://www.securitytracker.com/id/1033951
- http://www.ubuntu.com/usn/USN-2783-1
- https://bto.bluecoat.com/security-advisory/sa103
- https://bugzilla.redhat.com/show_bug.cgi?id=1274184
- https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
- https://eprint.iacr.org/2015/1020.pdf
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05270839
- https://security.gentoo.org/glsa/201607-15
- https://security.netapp.com/advisory/ntap-20171004-0001/
- https://support.citrix.com/article/CTX220112
- https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
- https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11
- https://www.arista.com/en/support/advisories-notices/security-advisories/1212-security-advisory-0016
- https://www.cs.bu.edu/~goldbe/NTPattack.html
- https://www.kb.cert.org/vuls/id/718152
Products affected by CVE-2015-7705
-
cpe:2.3:a:citrix:xenserver:6.0.2
-
cpe:2.3:a:citrix:xenserver:6.2.0
-
cpe:2.3:a:citrix:xenserver:6.5
-
cpe:2.3:a:citrix:xenserver:7.0
-
cpe:2.3:a:netapp:oncommand_performance_manager:-
-
cpe:2.3:a:netapp:oncommand_unified_manager:-
-
cpe:2.3:a:ntp:ntp:4.2.0
-
cpe:2.3:a:ntp:ntp:4.2.2
-
cpe:2.3:a:ntp:ntp:4.2.4
-
cpe:2.3:a:ntp:ntp:4.2.5
-
cpe:2.3:a:ntp:ntp:4.2.6
-
cpe:2.3:a:ntp:ntp:4.2.7
-
cpe:2.3:a:ntp:ntp:4.2.7p444
-
cpe:2.3:a:ntp:ntp:4.2.8
-
cpe:2.3:a:ntp:ntp:4.3.0
-
cpe:2.3:a:ntp:ntp:4.3.1
-
cpe:2.3:a:ntp:ntp:4.3.10
-
cpe:2.3:a:ntp:ntp:4.3.11
-
cpe:2.3:a:ntp:ntp:4.3.12
-
cpe:2.3:a:ntp:ntp:4.3.13
-
cpe:2.3:a:ntp:ntp:4.3.14
-
cpe:2.3:a:ntp:ntp:4.3.15
-
cpe:2.3:a:ntp:ntp:4.3.16
-
cpe:2.3:a:ntp:ntp:4.3.17
-
cpe:2.3:a:ntp:ntp:4.3.18
-
cpe:2.3:a:ntp:ntp:4.3.19
-
cpe:2.3:a:ntp:ntp:4.3.2
-
cpe:2.3:a:ntp:ntp:4.3.20
-
cpe:2.3:a:ntp:ntp:4.3.21
-
cpe:2.3:a:ntp:ntp:4.3.22
-
cpe:2.3:a:ntp:ntp:4.3.23
-
cpe:2.3:a:ntp:ntp:4.3.24
-
cpe:2.3:a:ntp:ntp:4.3.25
-
cpe:2.3:a:ntp:ntp:4.3.26
-
cpe:2.3:a:ntp:ntp:4.3.27
-
cpe:2.3:a:ntp:ntp:4.3.28
-
cpe:2.3:a:ntp:ntp:4.3.29
-
cpe:2.3:a:ntp:ntp:4.3.3
-
cpe:2.3:a:ntp:ntp:4.3.30
-
cpe:2.3:a:ntp:ntp:4.3.31
-
cpe:2.3:a:ntp:ntp:4.3.32
-
cpe:2.3:a:ntp:ntp:4.3.33
-
cpe:2.3:a:ntp:ntp:4.3.34
-
cpe:2.3:a:ntp:ntp:4.3.35
-
cpe:2.3:a:ntp:ntp:4.3.36
-
cpe:2.3:a:ntp:ntp:4.3.37
-
cpe:2.3:a:ntp:ntp:4.3.38
-
cpe:2.3:a:ntp:ntp:4.3.39
-
cpe:2.3:a:ntp:ntp:4.3.4
-
cpe:2.3:a:ntp:ntp:4.3.40
-
cpe:2.3:a:ntp:ntp:4.3.41
-
cpe:2.3:a:ntp:ntp:4.3.42
-
cpe:2.3:a:ntp:ntp:4.3.43
-
cpe:2.3:a:ntp:ntp:4.3.44
-
cpe:2.3:a:ntp:ntp:4.3.45
-
cpe:2.3:a:ntp:ntp:4.3.46
-
cpe:2.3:a:ntp:ntp:4.3.47
-
cpe:2.3:a:ntp:ntp:4.3.48
-
cpe:2.3:a:ntp:ntp:4.3.49
-
cpe:2.3:a:ntp:ntp:4.3.5
-
cpe:2.3:a:ntp:ntp:4.3.50
-
cpe:2.3:a:ntp:ntp:4.3.51
-
cpe:2.3:a:ntp:ntp:4.3.52
-
cpe:2.3:a:ntp:ntp:4.3.53
-
cpe:2.3:a:ntp:ntp:4.3.54
-
cpe:2.3:a:ntp:ntp:4.3.55
-
cpe:2.3:a:ntp:ntp:4.3.56
-
cpe:2.3:a:ntp:ntp:4.3.57
-
cpe:2.3:a:ntp:ntp:4.3.58
-
cpe:2.3:a:ntp:ntp:4.3.59
-
cpe:2.3:a:ntp:ntp:4.3.6
-
cpe:2.3:a:ntp:ntp:4.3.60
-
cpe:2.3:a:ntp:ntp:4.3.61
-
cpe:2.3:a:ntp:ntp:4.3.62
-
cpe:2.3:a:ntp:ntp:4.3.63
-
cpe:2.3:a:ntp:ntp:4.3.64
-
cpe:2.3:a:ntp:ntp:4.3.65
-
cpe:2.3:a:ntp:ntp:4.3.66
-
cpe:2.3:a:ntp:ntp:4.3.67
-
cpe:2.3:a:ntp:ntp:4.3.68
-
cpe:2.3:a:ntp:ntp:4.3.69
-
cpe:2.3:a:ntp:ntp:4.3.7
-
cpe:2.3:a:ntp:ntp:4.3.70
-
cpe:2.3:a:ntp:ntp:4.3.71
-
cpe:2.3:a:ntp:ntp:4.3.72
-
cpe:2.3:a:ntp:ntp:4.3.73
-
cpe:2.3:a:ntp:ntp:4.3.74
-
cpe:2.3:a:ntp:ntp:4.3.75
-
cpe:2.3:a:ntp:ntp:4.3.76
-
cpe:2.3:a:ntp:ntp:4.3.8
-
cpe:2.3:a:ntp:ntp:4.3.9
-
cpe:2.3:h:siemens:tim_4r-ie:-
-
cpe:2.3:h:siemens:tim_4r-ie_dnp3:-
-
cpe:2.3:o:netapp:clustered_data_ontap:-
-
cpe:2.3:o:netapp:data_ontap:-
-
cpe:2.3:o:siemens:tim_4r-ie_dnp3_firmware:-
-
cpe:2.3:o:siemens:tim_4r-ie_dnp3_firmware:3.3
-
cpe:2.3:o:siemens:tim_4r-ie_firmware:-
-
cpe:2.3:o:siemens:tim_4r-ie_firmware:3.3