CVE-2015-7852 ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.
MediumCVSS 5.9
EPSS 12.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ntp(Debian:11) | < 1:4.2.8p4+dfsg-1 | 1:4.2.8p4+dfsg-1 |
| ntp | >= 4.2.0, < 4.2.8 | 4.2.8 |
| ntp | >= 4.3.0, < 4.3.77 | 4.3.77 |
| ntp | = 4.2.8 | No fix listed |
| ntp | = 4.2.8-p1 | No fix listed |
| ntp | = 4.2.8-p1-beta1 | No fix listed |
| ntp | = 4.2.8-p1-beta2 | No fix listed |
| ntp | = 4.2.8-p1-beta3 | No fix listed |
| ntp | = 4.2.8-p1-beta4 | No fix listed |
| ntp | = 4.2.8-p1-beta5 | No fix listed |
| ntp | = 4.2.8-p1-rc1 | No fix listed |
| ntp | = 4.2.8-p1-rc2 | No fix listed |
| ntp | = 4.2.8-p2 | No fix listed |
| ntp | = 4.2.8-p2-rc1 | No fix listed |
| ntp | = 4.2.8-p2-rc2 | No fix listed |
| ntp | = 4.2.8-p2-rc3 | No fix listed |
| ntp | = 4.2.8-p3 | No fix listed |
| ntp | = 4.2.8-p3-rc1 | No fix listed |
| ntp | = 4.2.8-p3-rc2 | No fix listed |
| ntp | = 4.2.8-p3-rc3 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| netapp oncommand performance manager | All versions | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| netapp oncommand unified manager | All versions | No fix listed |
| netapp clustered data ontap | All versions | No fix listed |
| netapp data ontap | All versions | No fix listed |
| oracle linux | = 6 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- RHSA-2016:0780 third-party-advisory vendor-advisory
- RHSA-2016:2583 third-party-advisory vendor-advisory
- support.ntp.org patch vendor-advisory
- DSA-3388 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- 77288 third-party-advisory vdb-entry
- 1033951 third-party-advisory vdb-entry
- GLSA-201607-15 third-party-advisory vdb-entry vendor-advisory
- security.netapp.com third-party-advisory