CVE-2015-7705

Published: Aug 7, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.

Affected (29)

Products: Ntp: Ntp · Netapp: Clustered Data Ontap, Data Ontap, Oncommand Performance Manager, Oncommand Unified Manager · Citrix: Xenserver · +1 more

Show all products

Ntp: Ntp · Netapp: Clustered Data Ontap, Data Ontap, Oncommand Performance Manager, Oncommand Unified Manager · Citrix: Xenserver · Siemens: Tim 4r Ie Firmware, Tim 4r Ie Dnp3 Firmware

1 product

4 products

Oncommand Performance Manager

Oncommand Unified Manager

1 product

2 products

Tim 4r Ie Dnp3 Firmware

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Ntp Ntp	From 4.2.0 to 4.2.8
Ntp Ntp	From 4.3.0 to 4.3.77
Ntp Ntp	Version 4.2.8
Ntp Ntp	Version 4.2.8 p1-beta1
Ntp Ntp	Version 4.2.8 p1-beta2
Ntp Ntp	Version 4.2.8 p1-beta3
Ntp Ntp	Version 4.2.8 p1-beta4
Ntp Ntp	Version 4.2.8 p1-beta5
Ntp Ntp	Version 4.2.8 p1-rc1
Ntp Ntp	Version 4.2.8 p1-rc2
Ntp Ntp	Version 4.2.8 p1
Ntp Ntp	Version 4.2.8 p2-rc1
Ntp Ntp	Version 4.2.8 p2-rc2
Ntp Ntp	Version 4.2.8 p2-rc3
Ntp Ntp	Version 4.2.8 p2
Ntp Ntp	Version 4.2.8 p3-rc1
Ntp Ntp	Version 4.2.8 p3-rc2
Ntp Ntp	Version 4.2.8 p3-rc3
Ntp Ntp	Version 4.2.8 p3

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Netapp Clustered Data Ontap	All versions
Netapp Data Ontap	All versions
Netapp Oncommand Performance Manager	All versions
Netapp Oncommand Unified Manager	All versions

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Citrix Xenserver	Version 6.0.2
Citrix Xenserver	Version 6.2.0
Citrix Xenserver	Version 6.5
Citrix Xenserver	Version 7.0

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Tim 4r Ie Firmware	All versions

Running on/with	Platform Versions
Siemens Tim 4r Ie	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Tim 4r Ie Dnp3 Firmware	All versions

Running on/with	Platform Versions
Siemens Tim 4r Ie Dnp3	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (72)

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2015-11/msg00093.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html

Source: cve@mitre.org

http://packetstormsecurity.com/files/134137/Slackware-Security-Advisory-ntp-Updates.html

Source: cve@mitre.org

http://support.ntp.org/bin/view/Main/NtpBug2901

Source: cve@mitre.org

Vendor Advisory

http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_4_2_8p4_Securit

Source: cve@mitre.org

Release NotesVendor Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-ntp

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/536737/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/536796/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/archive/1/536737/100/100/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/archive/1/536796/100/100/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/77284

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1033951

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2783-1

Source: cve@mitre.org

https://bto.bluecoat.com/security-advisory/sa103

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=1274184

Source: cve@mitre.org

Issue TrackingThird Party AdvisoryVDB Entry

https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf

Source: cve@mitre.org

https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf

Source: cve@mitre.org

Third Party Advisory

https://eprint.iacr.org/2015/1020.pdf

Source: cve@mitre.org

Technical Description

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05270839

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://security.gentoo.org/glsa/201607-15

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://security.netapp.com/advisory/ntap-20171004-0001/

Source: cve@mitre.org

Third Party Advisory

https://support.citrix.com/article/CTX220112

Source: cve@mitre.org

Third Party Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11

Source: cve@mitre.org

https://www.arista.com/en/support/advisories-notices/security-advisories/1212-security-advisory-0016

Source: cve@mitre.org

https://www.cs.bu.edu/~goldbe/NTPattack.html

Source: cve@mitre.org

Not Applicable

https://www.kb.cert.org/vuls/id/718152

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html