CVE-2015-7705 The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
CriticalCVSS 9.8
EPSS 12.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ntp(Debian:11) | < 1:4.2.8p4+dfsg-3 | 1:4.2.8p4+dfsg-3 |
| ntp | >= 4.2.0, < 4.2.8 | 4.2.8 |
| ntp | >= 4.3.0, < 4.3.77 | 4.3.77 |
| ntp | = 4.2.8 | No fix listed |
| ntp | = 4.2.8-p1 | No fix listed |
| ntp | = 4.2.8-p1-beta1 | No fix listed |
| ntp | = 4.2.8-p1-beta2 | No fix listed |
| ntp | = 4.2.8-p1-beta3 | No fix listed |
| ntp | = 4.2.8-p1-beta4 | No fix listed |
| ntp | = 4.2.8-p1-beta5 | No fix listed |
| ntp | = 4.2.8-p1-rc1 | No fix listed |
| ntp | = 4.2.8-p1-rc2 | No fix listed |
| ntp | = 4.2.8-p2 | No fix listed |
| ntp | = 4.2.8-p2-rc1 | No fix listed |
| ntp | = 4.2.8-p2-rc2 | No fix listed |
| ntp | = 4.2.8-p2-rc3 | No fix listed |
| ntp | = 4.2.8-p3 | No fix listed |
| ntp | = 4.2.8-p3-rc1 | No fix listed |
| ntp | = 4.2.8-p3-rc2 | No fix listed |
| ntp | = 4.2.8-p3-rc3 | No fix listed |
| netapp oncommand performance manager | All versions | No fix listed |
| netapp oncommand unified manager | All versions | No fix listed |
| netapp clustered data ontap | All versions | No fix listed |
| netapp data ontap | All versions | No fix listed |
| citrix xenserver | = 6.0.2 | No fix listed |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| citrix xenserver | = 6.2.0 | No fix listed |
| citrix xenserver | = 6.5 | No fix listed |
| citrix xenserver | = 7.0 | No fix listed |
| Siemens tim 4r-ie firmware | All versions | No fix listed |
| Siemens tim 4r-ie dnp3 firmware | All versions | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- SUSE-SU-2016:1247 vendor-advisory
- SUSE-SU-2016:1278 vendor-advisory
- SUSE-SU-2016:1291 vendor-advisory
- SUSE-SU-2016:1311 vendor-advisory
- openSUSE-SU-2016:1329 vendor-advisory
- SUSE-SU-2016:1471 vendor-advisory
- SUSE-SU-2016:1568 vendor-advisory
- SUSE-SU-2016:1912 vendor-advisory
- SUSE-SU-2016:2094 vendor-advisory
- openSUSE-SU-2015:2016 vendor-advisory
- openSUSE-SU-2016:1423 vendor-advisory
- packetstormsecurity.com
- support.ntp.org vendor-advisory
- support.ntp.org release-notes vendor-advisory
- 20151021 Multiple Vulnerabilities in ntpd Affecting Cisco Products - October 2015 vendor-advisory
- 20151022 Cisco Security Advisory: Multiple Vulnerabilities in ntpd Affecting Cisco Products - October 2015 mailing-list
- 20151029 [slackware-security] ntp (SSA:2015-302-03) mailing-list
- 20151022 Cisco Security Advisory: Multiple Vulnerabilities in ntpd Affecting Cisco Products - October 2015 mailing-list
- 20151029 [slackware-security] ntp (SSA:2015-302-03) mailing-list
- 77284 third-party-advisory vdb-entry
- 1033951 third-party-advisory vdb-entry
- USN-2783-1 vendor-advisory
- bto.bluecoat.com
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- cert-portal.siemens.com
- cert-portal.siemens.com third-party-advisory
- eprint.iacr.org technical-description
- h20566.www2.hpe.com third-party-advisory vdb-entry
- GLSA-201607-15 third-party-advisory vdb-entry vendor-advisory
- security.netapp.com third-party-advisory
- support.citrix.com third-party-advisory
- us-cert.cisa.gov third-party-advisory us-government-resource
- us-cert.cisa.gov
- www.arista.com
- www.cs.bu.edu not-applicable
- VU#718152 third-party-advisory us-government-resource