Is CVE-2015-7978 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-7978 being exploited in the wild.

How severe is CVE-2015-7978?

High severity, with a CVSS score of 7.5, published 30 January 2017.

Which products and versions are affected?

NTP Project NTP 4.2.8p6 and earlier, 4.3.0 through 4.3.89.

Is there a fix for CVE-2015-7978?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2015-7978 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2015-7978?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-7978: NTP Project NTP denial of service via stack exhaustion in ntpdc

CVE-2015-7978 · Severity: high · CVSS 7.5 · Published 2017-01-30

A vulnerability in the Network Time Protocol (NTP) service, which synchronizes clocks across computer networks, could allow an attacker to crash the service. By sending a specific command, a remote attacker can cause the system to exhaust its memory resources, leading to a denial of service. This can disrupt time-sensitive operations and security protocols that rely on accurate system clocks.

Quick answers

Is CVE-2015-7978 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-7978 being exploited in the wild.
How severe is CVE-2015-7978?: High severity, with a CVSS score of 7.5, published 30 January 2017.
Which products and versions are affected?: NTP Project NTP 4.2.8p6 and earlier, 4.3.0 through 4.3.89.
Is there a fix for CVE-2015-7978?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2015-7978 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2015-7978?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack exhaustion vulnerability exists in the NTP daemon (ntpd) when processing 'ntpdc relist' commands. The flaw is rooted in the recursive traversal of the restriction list; an attacker can trigger this recursion remotely without authentication. Successful exploitation leads to a crash of the ntpd process, resulting in a denial of service. This issue affects NTP versions prior to 4.2.8p6 and the 4.3 development branch prior to 4.3.90. Users are advised to upgrade to NTP 4.2.8p6 or later.

Affected products

NTP Project NTP 4.2.8p6 and earlier, 4.3.0 through 4.3.89

Timeline

2016-01-27: advisory: Cisco security advisory published
2017-01-30: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.