An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/77275 | Broken Link |
| http://www.securitytracker.com/id/1033951 | Broken Link |
| http://www.talosintelligence.com/reports/TALOS-2015-0052/ | Exploit Technical Description Third Party Advisory VDB Entry |
| https://security.gentoo.org/glsa/201607-15 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20171004-0001/ | Third Party Advisory |
| http://www.securityfocus.com/bid/77275 | Broken Link |
| http://www.securitytracker.com/id/1033951 | Broken Link |
| http://www.talosintelligence.com/reports/TALOS-2015-0052/ | Exploit Technical Description Third Party Advisory VDB Entry |
| https://security.gentoo.org/glsa/201607-15 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20171004-0001/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
23 May 2025, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Netapp oncommand Balance
Netapp data Ontap Operating In 7-mode Netapp Ntp ntp Netapp oncommand Unified Manager Netapp clustered Data Ontap Netapp oncommand Performance Manager |
|
| CPE | cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:clustered_data_ontap:*:* cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:* cpe:2.3:a:netapp:data_ontap_operating_in_7-mode:-:*:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_balance:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:* cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:* |
|
| References | () http://www.securityfocus.com/bid/77275 - Broken Link | |
| References | () http://www.securitytracker.com/id/1033951 - Broken Link | |
| References | () https://security.gentoo.org/glsa/201607-15 - Third Party Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20171004-0001/ - Third Party Advisory |
21 Nov 2024, 02:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/77275 - | |
| References | () http://www.securitytracker.com/id/1033951 - | |
| References | () http://www.talosintelligence.com/reports/TALOS-2015-0052/ - Exploit, Technical Description, Third Party Advisory, VDB Entry | |
| References | () https://security.gentoo.org/glsa/201607-15 - | |
| References | () https://security.netapp.com/advisory/ntap-20171004-0001/ - |
Information
Published : 2017-01-06 21:59
Updated : 2025-05-23 02:15
NVD link : CVE-2015-7848
Mitre link : CVE-2015-7848
CVE.ORG link : CVE-2015-7848
JSON object : View
Products Affected
netapp
- oncommand_performance_manager
- data_ontap_operating_in_7-mode
- oncommand_balance
- clustered_data_ontap
- oncommand_unified_manager
ntp
- ntp
CWE
CWE-190
Integer Overflow or Wraparound