# CVE-2015-7973: NTP replay attack in broadcast mode

Source: https://junglewise.ai/threats/cve-2015-7973-ntp-replay-attack-in-broadcast-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-30. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2015-7973 · Severity: medium · CVSS 6.5 · Published 2017-01-30

The Network Time Protocol (NTP) service, which synchronizes clocks across computer systems, contains a vulnerability when used in broadcast mode. An attacker positioned on the network can capture and resend legitimate time synchronization messages to disrupt the accuracy of system clocks. This can lead to service instability or the failure of security protocols that rely on precise timekeeping.

## Quick answers

**Is CVE-2015-7973 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-7973 being exploited in the wild.

**How severe is CVE-2015-7973?** Medium severity, with a CVSS score of 6.5, published 30 January 2017.

**Which products and versions are affected?** NTP Project NTP Before 4.2.8p6, 4.3.x before 4.3.90.

**Is there a fix for CVE-2015-7973?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2015-7973 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2015-7973?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A replay vulnerability exists in NTP's broadcast mode implementation. When NTP is configured to receive time signals via broadcast, it fails to properly validate or uniquely identify packets to prevent them from being re-sent. A man-in-the-middle attacker can sniff legitimate broadcast packets and replay them to a client, potentially causing clock skew or denial of service. This issue is resolved in NTP versions 4.2.8p6 and 4.3.90.

## Affected products

- NTP Project NTP Before 4.2.8p6, 4.3.x before 4.3.90

## Timeline

- 2016-01-19: advisory: Vendor advisory (NTP Bug 2935) published
- 2017-01-30: disclosed: NVD publication date

## References

- [http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html](http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html](http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html](http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html](http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html](http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html](http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html](http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html)