# CVE-2015-7977: NTP Project ntpd denial of service via reslist command

Source: https://junglewise.ai/threats/cve-2015-7977-ntp-project-ntpd-denial-of-service-via-reslist-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-30. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2015-7977 · Severity: medium · CVSS 5.9 · Published 2017-01-30

A vulnerability in the Network Time Protocol daemon (ntpd) could allow a remote attacker to crash the service, causing a denial of service. This software is critical for synchronizing clocks across computer networks, and an outage can disrupt time-sensitive operations and security protocols. The issue is triggered by sending a specific command to the service.

Technologies: [NTP Project Ntpd](https://junglewise.ai/threats/technologies/ntpd). Vendors: [NTP Project](https://junglewise.ai/threats/vendors/ntp-project).

## Quick answers

**Is CVE-2015-7977 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-7977 being exploited in the wild.

**How severe is CVE-2015-7977?** Medium severity, with a CVSS score of 5.9, published 30 January 2017.

**Which products and versions are affected?** NTP Project Ntpd before 4.2.8p6, 4.3.x before 4.3.90.

**Is there a fix for CVE-2015-7977?** A patch was published on 2016-01-19: NTP 4.2.8p6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-7977 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2015-7977?** Check whether you run NTP Project Ntpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A NULL pointer dereference vulnerability exists in the ntpd component of NTP. The flaw is triggered when the service processes a 'reslist' command via ntpdc. A remote, unauthenticated attacker can exploit this to cause the ntpd process to crash, resulting in a denial of service. The vulnerability is present in versions prior to 4.2.8p6 and 4.3.x versions prior to 4.3.90. Users are advised to upgrade to a patched version to mitigate this risk.

## Affected products

- NTP Project ntpd before 4.2.8p6, 4.3.x before 4.3.90

## Timeline

- 2016-01-19: patched: NTP 4.2.8p6 released
- 2017-01-30: disclosed: NVD publication date

## References

- [http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html](http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html)
- [http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.html](http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html](http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html](http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html](http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html](http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html](http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html)

## Related threats

- [NTP ntpd denial of service in ctl_getitem](https://junglewise.ai/threats/cve-2016-2519-ntp-ntpd-denial-of-service-in-ctl-getitem)
- [NTP Project ntpd origin timestamp validation bypass](https://junglewise.ai/threats/cve-2015-8138-ntp-project-ntpd-origin-timestamp-validation-bypass)
- [NTP Project ntpd denial of service via large UDP packet on Windows](https://junglewise.ai/threats/cve-2016-9312-ntp-project-ntpd-denial-of-service-via-large-udp-packet-on-windows)
- [NTP Project ntpd denial of service in trap service](https://junglewise.ai/threats/cve-2016-9311-ntp-project-ntpd-denial-of-service-in-trap-service)
- [NTP ntpd information disclosure and DDoS vector in mode 6 control functionality](https://junglewise.ai/threats/cve-2016-9310-ntp-ntpd-information-disclosure-and-ddos-vector-in-mode-6-control)