CVE-2015-7705: Input Validation
A flaw was found in the way NTP handled rate limiting. An attacker able to send a large number of crafted requests to an NTP server could trigger the rate limiting on that server, and prevent clients from getting a usable reply from the server.
The default NTP configuration in Red Hat Enterprise Linux does not enable rate limiting.
External References:
https://www.cs.bu.edu/~goldbe/NTPattack.html
Other sources
The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
— MITRE
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2015-7705?
The severity of CVE-2015-7705 is considered to be high as it can lead to denial of service by exhausting the NTP server's response capabilities.
How do I fix CVE-2015-7705?
To fix CVE-2015-7705, you should upgrade the NTP software to version 4.2.8 or later.
What systems are affected by CVE-2015-7705?
CVE-2015-7705 affects NTP versions prior to 4.2.8 along with specific Siemens TIM and NetApp products.
Can CVE-2015-7705 be exploited remotely?
Yes, CVE-2015-7705 can be exploited remotely by attackers sending crafted requests to an NTP server.
What are the potential impacts of CVE-2015-7705?
The potential impacts of CVE-2015-7705 include denial of service, which can prevent clients from receiving valid time responses from the NTP server.