crítica
CVE-2015-7705
ntp: denial of service by trigerring rate limiting on NTP server
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.3AV:N/AC:M/Au:N/C:N/I:N/A:P
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Ubuntu (media).
Descripción
The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | ntp | 1:4.2.8p4+dfsg-3 |
| debian 7 | ntp | sin corrección indicada |
| debian 8 | ntp | sin corrección indicada |
| Red Hat | ntp, ntp-doc, ntp-perl y 2 más | sin corrección indicada |
| ubuntu 12.04 | ntp | 1:4.2.6.p3+dfsg-1ubuntu3.6 |
| ubuntu 14.04 | ntp | 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5 |
| ubuntu 14.04-ESM | ntp | 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5 |
| ubuntu 15.04 | ntp | 1:4.2.6.p5+dfsg-3ubuntu6.2 |
| ubuntu 15.10 | ntp | 1:4.2.6.p5+dfsg-3ubuntu8.1 |
Mostrar las 13 entradas de 9 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | ntp | 1:4.2.8p4+dfsg-3 |
| debian 7 | ntp | sin corrección indicada |
| debian 8 | ntp | sin corrección indicada |
| Red Hat | ntp | sin corrección indicada |
| Red Hat | ntp-doc | sin corrección indicada |
| Red Hat | ntp-perl | sin corrección indicada |
| Red Hat | ntpdate | sin corrección indicada |
| Red Hat | sntp | sin corrección indicada |
| ubuntu 12.04 | ntp | 1:4.2.6.p3+dfsg-1ubuntu3.6 |
| ubuntu 14.04 | ntp | 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5 |
| ubuntu 14.04-ESM | ntp | 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5 |
| ubuntu 15.04 | ntp | 1:4.2.6.p5+dfsg-3ubuntu6.2 |
| ubuntu 15.10 | ntp | 1:4.2.6.p5+dfsg-3ubuntu8.1 |
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
Las 42 referencias
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00093.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
- http://packetstormsecurity.com/files/134137/Slackware-Security-Advisory-ntp-Updates.html
- http://support.ntp.org/bin/view/Main/NtpBug2901
- http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_4_2_8p4_Securit
- http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-ntp
- http://www.cs.bu.edu/~goldbe/NTPattack.html
- http://www.securityfocus.com/archive/1/536737/100/0/threaded
- http://www.securityfocus.com/archive/1/536796/100/0/threaded
- http://www.securityfocus.com/archive/1/archive/1/536737/100/100/threaded
- http://www.securityfocus.com/archive/1/archive/1/536796/100/100/threaded
- http://www.securityfocus.com/bid/77284
- http://www.securitytracker.com/id/1033951
- http://www.ubuntu.com/usn/USN-2783-1
- https://access.redhat.com/security/cve/CVE-2015-7705
- https://bto.bluecoat.com/security-advisory/sa103
- https://bugzilla.redhat.com/show_bug.cgi?id=1274184
- https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
- https://eprint.iacr.org/2015/1020.pdf
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05270839
- https://nvd.nist.gov/vuln/detail/CVE-2015-7705
- https://security.gentoo.org/glsa/201607-15
- https://security.netapp.com/advisory/ntap-20171004-0001/
- https://support.citrix.com/article/CTX220112
- https://ubuntu.com/security/notices/USN-2783-1
- https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
- https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11
- https://www.arista.com/en/support/advisories-notices/security-advisories/1212-security-advisory-0016
- https://www.cs.bu.edu/~goldbe/NTPattack.html
- https://www.cve.org/CVERecord?id=CVE-2015-7705
- https://www.kb.cert.org/vuls/id/718152