CVE-2015-7977

CWE-476 — NULL Pointer DereferenceCWE-119 — Buffer OverflowCWE-20 — Improper Input ValidationCWE-200 — Information ExposureCWE-287 — Improper AuthenticationCWE-39912 documents10 sources
Severity
5.9MEDIUM
EPSS
16.4%
top 5.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
NTP NTPCanonical Ubuntu LinuxDebian Debian Linux+3 more
Timeline
PublishedJan 30
Latest updateMay 13

Description

ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages3 packages

▶NVDntp/ntp4.3.0 — 4.3.90+2
▶Debianntp< 1:4.2.8p7+dfsg-1

Also affects: Freebsd 10.1, 10.2, 9.3, Debian Linux 8.0, 9.0, Fedora 22, 23, Ubuntu Linux 12.04, 14.04, 16.04

🔴Vulnerability Details

3
GHSA
GHSA-cvp4-369g-vpfx: ntpd in NTP before 4↗2022-05-13
▶
CVEList
CVE-2015-7977: ntpd in NTP before 4↗2017-01-30
▶
OSV
CVE-2015-7977: ntpd in NTP before 4↗2017-01-30
▶

📋Vendor Advisories

5
Ubuntu
NTP vulnerabilities↗2016-10-05
▶
Cisco
Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: January 2016↗2016-01-28
▶
BSD
FreeBSD-SA-16:09.ntp: Multiple vulnerabilities of ntp↗2016-01-27
▶
Red Hat
ntp: restriction list NULL pointer dereference↗2016-01-20
▶
Debian
CVE-2015-7977: ntp - ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to ca...↗2015
▶

💬Community

3
Bugzilla
CVE-2015-7978 ntp: stack exhaustion in recursive traversal of restriction list↗2016-01-20
▶
Bugzilla
CVE-2015-7977 ntp: restriction list NULL pointer dereference↗2016-01-20
▶
Bugzilla
CVE-2015-7974 CVE-2015-8138 CVE-2015-7973 CVE-2015-7975 CVE-2015-7976 CVE-2015-7977 CVE-2015-7978 CVE-2015-7979 CVE-2015-8158 CVE-2015-8139 CVE-2015-8140 ntp: various flaws [fedora-all]↗2016-01-20
▶