CVE-2015-7977

high-risk
Published 2017-01-30

ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.

Do I need to act?

!
16.4% chance of exploitation in next 30 days
EPSS score — higher than 84% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
NETWORK / HIGH complexity

Affected Products (20)

Ntp
Ntp
Ntp
Ntp
Ntp
Ntp
Ntp
Ntp
Ntp
Ntp

Affected Vendors

Netapp Ntp Oracle Debian Canonical Fedoraproject Siemens Freebsd

References (54)

Third Party Advisory http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.h...
Third Party Advisory http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.ht...
Broken Link http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html
Broken Link http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html
Broken Link http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html
Broken Link http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html
Broken Link http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html
Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
Broken Link http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
Broken Link http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
Broken Link http://rhn.redhat.com/errata/RHSA-2016-0780.html
Broken Link http://rhn.redhat.com/errata/RHSA-2016-2583.html
Vendor Advisory http://support.ntp.org/bin/view/Main/NtpBug2939
Vendor Advisory http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Secur...
Third Party Advisory http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20...
Third Party Advisory http://www.debian.org/security/2016/dsa-3629
Third Party Advisory http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.h...
Third Party Advisory http://www.securityfocus.com/bid/81815
Third Party Advisory http://www.securitytracker.com/id/1034782
Third Party Advisory http://www.ubuntu.com/usn/USN-3096-1
and 34 more references
60
/ 100
high-risk
Severity 18/34 · Moderate
Exploitability 13/34 · Low
Exposure 29/34 · Critical