CVE-2015-7704: Input Validation
The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.
Other sources
When ntpd as an NTP client receives a Kiss-of-Death (KoD) packet from the server to reduce its polling rate, it doesn't check if the originate timestamp in the reply matches the transmit timestamp from its request. An off-path attacker can send a crafted KoD packet to the client, which will increase the client's polling interval to a large value and effectively disable synchronization with the server.
This issue affects ntp versions 4.2.6 and 4.2.8 up to 4.2.8p3.
The attacker can find out to what server the client is currently synchronized by sending it a regular client mode packet and checking the refid field in the reply (the refid is IPv4 address or first four bytes of MD5 sum of IPv6 address).
Upstream bug:
http://bugs.ntp.org/showbug.cgi?id=2901
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7704?
CVE-2015-7704 has a severity rating that indicates it can lead to denial of service situations under specific conditions.
How do I fix CVE-2015-7704?
To fix CVE-2015-7704, update NTP to versions higher than 4.2.8p4 or 4.3.77.
Which versions of NTP are affected by CVE-2015-7704?
CVE-2015-7704 affects NTP versions prior to 4.2.8p4 and those in the 4.3.x branch before 4.3.77.
What type of attacks does CVE-2015-7704 enable?
CVE-2015-7704 enables remote attackers to perform denial of service attacks via crafted Kiss-of-Death messages.
Can CVE-2015-7704 be exploited remotely?
Yes, CVE-2015-7704 can be exploited remotely by sending specially crafted messages to vulnerable NTP clients.