WaratekVRT Sign in

CVE-2015-7855 ntp

Affected softwarentp
Severity6.5 Medium CVSS 3.1 2 scores
WeaknessImproper input validation (CWE-20)
Published7 Aug 2017
Updated17 Jun 2026

Description

The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2016-11-28.
  • EPSS 31% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.
IndexArtifactStarsFirst seen
Exploit-DB NTP 4.2.8p3 - Denial of Service 2016-11-28

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

6.5 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H NVD Primary published
CVSS 2.0 4.0 none AV:N/AC:L/Au:S/C:N/I:N/A:P NVD Primary

Affected software and releases

Products and versions

9 products, 29 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 7.0 · 8.0 · 9.0
nvd netapp clustered data ontap generic any version
nvd netapp data ontap generic any version
nvd netapp oncommand balance generic any version
nvd netapp oncommand performance manager generic any version
nvd netapp oncommand unified manager generic any version
nvd ntp ntp generic ≥ 4.2.0 and ＜ 4.2.8 · 4.2.8 · 4.2.8:p1 · 4.2.8:p1-beta1 · 4.2.8:p1-beta2 · 4.2.8:p1-beta3 · 4.2.8:p1-beta4 · 4.2.8:p1-beta5 · 4.2.8:p1-rc1 · 4.2.8:p1-rc2 · 4.2.8:p2 · 4.2.8:p2-rc1 · 4.2.8:p2-rc2 · 4.2.8:p2-rc3 · 4.2.8:p3 · 4.2.8:p3-rc1 · 4.2.8:p3-rc2 · 4.2.8:p3-rc3 · ≥ 4.3.0 and ＜ 4.3.77
nvd siemens tim 4r-ie dnp3 firmware generic any version
nvd siemens tim 4r-ie firmware generic any version

References

URLTags
http://support.ntp.org/bin/view/Main/NtpBug2922 Patch, Vendor Advisory
http://www.debian.org/security/2015/dsa-3388 Third Party Advisory
http://www.securityfocus.com/bid/77283 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1033951 Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1274264 Issue Tracking, Third Party Advisory, VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05270839 Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201607-15 Third Party Advisory, VDB Entry
https://security.netapp.com/advisory/ntap-20171004-0001/ Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11 Third Party Advisory, US Government Resource

Timeline
Published2017-08-07By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.