CVE-2015-7977: Null Pointer Dereference
Published Jan 30, 2017
·Updated
ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.
Affected Software
98 affected componentsFixes available
debian/ntp
1:4.2.8p12+dfsg-41:4.2.8p15+dfsg-1
Siemens TIM 4R-IE (incl. SIPLUS NET variants)
Siemens TIM 4R-IE DNP3 (incl. SIPLUS NET variants)
NTP ntp<=4.2.8
NTP ntp>=4.3.0<4.3.90
NTP ntp=4.2.8
NTP ntp=4.2.8-p1
NTP ntp=4.2.8-p1-beta1
NTP ntp=4.2.8-p1-beta2
NTP ntp=4.2.8-p1-beta3
NTP ntp=4.2.8-p1-beta4
NTP ntp=4.2.8-p1-beta5
NTP ntp=4.2.8-p1-rc1
NTP ntp=4.2.8-p1-rc2
NTP ntp=4.2.8-p2
NTP ntp=4.2.8-p2-rc1
NTP ntp=4.2.8-p2-rc2
NTP ntp=4.2.8-p2-rc3
NTP ntp=4.2.8-p3
NTP ntp=4.2.8-p3-rc1
NTP ntp=4.2.8-p3-rc2
NTP ntp=4.2.8-p3-rc3
NTP ntp=4.2.8-p4
NTP ntp=4.2.8-p5
Oracle Linux=6
Siemens Tim 4r-ie Firmware
Siemens Tim 4r-ie
Siemens Tim 4r-ie Dnp3 Firmware
Siemens Tim 4r-ie Dnp3
NetApp Clustered Data ONTAP
NetApp OnCommand Balance
FreeBSD FreeBSD=9.3
FreeBSD FreeBSD=9.3-p1
FreeBSD FreeBSD=9.3-p10
FreeBSD FreeBSD=9.3-p12
FreeBSD FreeBSD=9.3-p13
FreeBSD FreeBSD=9.3-p16
FreeBSD FreeBSD=9.3-p19
FreeBSD FreeBSD=9.3-p2
FreeBSD FreeBSD=9.3-p20
FreeBSD FreeBSD=9.3-p21
FreeBSD FreeBSD=9.3-p22
FreeBSD FreeBSD=9.3-p23
FreeBSD FreeBSD=9.3-p24
FreeBSD FreeBSD=9.3-p25
FreeBSD FreeBSD=9.3-p28
FreeBSD FreeBSD=9.3-p3
FreeBSD FreeBSD=9.3-p30
FreeBSD FreeBSD=9.3-p31
FreeBSD FreeBSD=9.3-p32
FreeBSD FreeBSD=9.3-p33
FreeBSD FreeBSD=9.3-p34
FreeBSD FreeBSD=9.3-p5
FreeBSD FreeBSD=9.3-p6
FreeBSD FreeBSD=9.3-p7
FreeBSD FreeBSD=9.3-p8
FreeBSD FreeBSD=9.3-p9
FreeBSD FreeBSD=10.1
FreeBSD FreeBSD=10.1-p1
FreeBSD FreeBSD=10.1-p10
FreeBSD FreeBSD=10.1-p12
FreeBSD FreeBSD=10.1-p15
FreeBSD FreeBSD=10.1-p16
FreeBSD FreeBSD=10.1-p17
FreeBSD FreeBSD=10.1-p18
FreeBSD FreeBSD=10.1-p19
FreeBSD FreeBSD=10.1-p2
FreeBSD FreeBSD=10.1-p22
FreeBSD FreeBSD=10.1-p24
FreeBSD FreeBSD=10.1-p25
FreeBSD FreeBSD=10.1-p26
FreeBSD FreeBSD=10.1-p27
FreeBSD FreeBSD=10.1-p3
FreeBSD FreeBSD=10.1-p4
FreeBSD FreeBSD=10.1-p5
FreeBSD FreeBSD=10.1-p6
FreeBSD FreeBSD=10.1-p7
FreeBSD FreeBSD=10.1-p8
FreeBSD FreeBSD=10.1-p9
FreeBSD FreeBSD=10.2
FreeBSD FreeBSD=10.2-p1
FreeBSD FreeBSD=10.2-p10
FreeBSD FreeBSD=10.2-p2
FreeBSD FreeBSD=10.2-p5
FreeBSD FreeBSD=10.2-p7
FreeBSD FreeBSD=10.2-p8
FreeBSD FreeBSD=10.2-p9
Fedoraproject Fedora=22
Fedoraproject Fedora=23
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
All of the following
Siemens Tim 4r-ie Firmware
Siemens Tim 4r-ie
All of the following
Siemens Tim 4r-ie Dnp3 Firmware
Siemens Tim 4r-ie Dnp3
Event History
Jan 30, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2015-7977?
CVE-2015-7977 has been classified as a moderate severity vulnerability that allows for denial of service via a NULL pointer dereference.
2
How do I fix CVE-2015-7977?
To resolve CVE-2015-7977, update NTP to versions 4.2.8p12 or higher, or 4.3.90 or higher.
3
What software is affected by CVE-2015-7977?
CVE-2015-7977 affects NTP versions before 4.2.8p6, and 4.3.x before 4.3.90, among others.
4
What type of vulnerability is CVE-2015-7977?
CVE-2015-7977 is a denial-of-service vulnerability caused by a NULL pointer dereference.
5
Can CVE-2015-7977 be exploited remotely?
Yes, CVE-2015-7977 can be exploited remotely using the ntpdc reslist command.