{"id":"CVE-2015-8140","aliases":["DEBIAN-CVE-2015-8140","EUVD-2015-8030","GHSA-6wrq-h82h-4vm8","SUSE-SU-2016:1175-1","SUSE-SU-2016:1177-1","SUSE-SU-2016:1247-1","SUSE-SU-2016:1311-1","SUSE-SU-2016:3193-1","SUSE-SU-2017:0255-1","UBUNTU-CVE-2015-8140"],"status":"published","title":"The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by...","description":"The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.","severity":{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04622,"percentile":0.91762,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2016-04-28T13:45:26Z","modified":"2026-08-27T23:00:13Z","fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.8p7+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p7+dfsg-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.22-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.22-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.22-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-8.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.22-6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-46.5.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.4-8.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.4-8.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-46.5.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.4-8.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-46.5.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12.4-8.2"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"yast2-ntp-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.14.1-1.12.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p6-41.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-57.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-57.2"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-48.9.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3","1:4.2.6.p5+dfsg-3ubuntu2.14.04.5","1:4.2.6.p5+dfsg-3ubuntu2.14.04.6","1:4.2.6.p5+dfsg-3ubuntu2.14.04.7","1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","1:4.2.6.p5+dfsg-3ubuntu2.14.04.10","1:4.2.6.p5+dfsg-3ubuntu2.14.04.11","1:4.2.6.p5+dfsg-3ubuntu2.14.04.12","1:4.2.6.p5+dfsg-3ubuntu2.14.04.13","1:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu8","1:4.2.6.p5+dfsg-3ubuntu8.1","1:4.2.6.p5+dfsg-3ubuntu9","1:4.2.8p4+dfsg-3ubuntu1","1:4.2.8p4+dfsg-3ubuntu2","1:4.2.8p4+dfsg-3ubuntu3","1:4.2.8p4+dfsg-3ubuntu4","1:4.2.8p4+dfsg-3ubuntu5","1:4.2.8p4+dfsg-3ubuntu5.1","1:4.2.8p4+dfsg-3ubuntu5.2","1:4.2.8p4+dfsg-3ubuntu5.3","1:4.2.8p4+dfsg-3ubuntu5.4","1:4.2.8p4+dfsg-3ubuntu5.5","1:4.2.8p4+dfsg-3ubuntu5.6","1:4.2.8p4+dfsg-3ubuntu5.7","1:4.2.8p4+dfsg-3ubuntu5.8","1:4.2.8p4+dfsg-3ubuntu5.9","1:4.2.8p4+dfsg-3ubuntu5.10"]}],"products":[{"vendor":"ntp","product":"ntp"}],"references":[{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1034782","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.kb.cert.org/vuls/id/718152","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://support.ntp.org/bin/view/Main/NtpBug2947","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred","advisory"]},{"url":"https://bto.bluecoat.com/security-advisory/sa113","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201607-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20200204-0003/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8140"},{"url":"https://security.netapp.com/advisory/ntap-20200204-0003"},{"url":"https://github.com/advisories/GHSA-6wrq-h82h-4vm8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8140","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161175-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/782060","tags":["report"]},{"url":"https://bugzilla.suse.com/784760","tags":["report"]},{"url":"https://bugzilla.suse.com/916617","tags":["report"]},{"url":"https://bugzilla.suse.com/951559","tags":["report"]},{"url":"https://bugzilla.suse.com/951629","tags":["report"]},{"url":"https://bugzilla.suse.com/956773","tags":["report"]},{"url":"https://bugzilla.suse.com/962318","tags":["report"]},{"url":"https://bugzilla.suse.com/962784","tags":["report"]},{"url":"https://bugzilla.suse.com/962802","tags":["report"]},{"url":"https://bugzilla.suse.com/962960","tags":["report"]},{"url":"https://bugzilla.suse.com/962966","tags":["report"]},{"url":"https://bugzilla.suse.com/962970","tags":["report"]},{"url":"https://bugzilla.suse.com/962988","tags":["report"]},{"url":"https://bugzilla.suse.com/962994","tags":["report"]},{"url":"https://bugzilla.suse.com/962995","tags":["report"]},{"url":"https://bugzilla.suse.com/962997","tags":["report"]},{"url":"https://bugzilla.suse.com/963000","tags":["report"]},{"url":"https://bugzilla.suse.com/963002","tags":["report"]},{"url":"https://bugzilla.suse.com/975496","tags":["report"]},{"url":"https://bugzilla.suse.com/975981","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8158","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161177-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/937837","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161247-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/905885","tags":["report"]},{"url":"https://bugzilla.suse.com/910063","tags":["report"]},{"url":"https://bugzilla.suse.com/920238","tags":["report"]},{"url":"https://bugzilla.suse.com/926510","tags":["report"]},{"url":"https://bugzilla.suse.com/936327","tags":["report"]},{"url":"https://bugzilla.suse.com/942587","tags":["report"]},{"url":"https://bugzilla.suse.com/944300","tags":["report"]},{"url":"https://bugzilla.suse.com/946386","tags":["report"]},{"url":"https://bugzilla.suse.com/951608","tags":["report"]},{"url":"https://bugzilla.suse.com/954982","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7871","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161311-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/920183","tags":["report"]},{"url":"https://bugzilla.suse.com/942441","tags":["report"]},{"url":"https://bugzilla.suse.com/943216","tags":["report"]},{"url":"https://bugzilla.suse.com/943218","tags":["report"]},{"url":"https://bugzilla.suse.com/951351","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5219","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20163193-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1009434","tags":["report"]},{"url":"https://bugzilla.suse.com/1011377","tags":["report"]},{"url":"https://bugzilla.suse.com/1011390","tags":["report"]},{"url":"https://bugzilla.suse.com/1011395","tags":["report"]},{"url":"https://bugzilla.suse.com/1011398","tags":["report"]},{"url":"https://bugzilla.suse.com/1011404","tags":["report"]},{"url":"https://bugzilla.suse.com/1011406","tags":["report"]},{"url":"https://bugzilla.suse.com/1011411","tags":["report"]},{"url":"https://bugzilla.suse.com/1011417","tags":["report"]},{"url":"https://bugzilla.suse.com/956365","tags":["report"]},{"url":"https://bugzilla.suse.com/981252","tags":["report"]},{"url":"https://bugzilla.suse.com/988028","tags":["report"]},{"url":"https://bugzilla.suse.com/992038","tags":["report"]},{"url":"https://bugzilla.suse.com/992606","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9311","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170255-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-8140","tags":["report"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit","tags":["report"]},{"url":"http://www.talosintel.com/reports/TALOS-2016-0079/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8140","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8140","description":"The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.","status":"published","published":"2017-01-30T21:00:00Z","modified":"2024-08-06T08:13:31.109Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-8030","description":"The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.","status":"published","published":"2017-01-30T21:00:00Z","modified":"2024-08-06T08:13:31Z","updated_at":"2026-11-03T01:57:28.296316Z"}],"ghsa":[{"id":"GHSA-6wrq-h82h-4vm8","title":"The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by...","description":"The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.","status":"published","published":"2022-05-17T00:22:32Z","modified":"2025-04-20T03:33:07Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:01:40.176288Z"}],"nvd":[{"id":"CVE-2015-8140","description":"The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.","status":"published","published":"2017-01-30T21:59:00.91Z","modified":"2026-06-17T00:34:05.47Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"CVE-2015-8140","description":"The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.","status":"published","published":"2017-01-30T21:59:00Z","modified":"2026-04-10T03:45:30.571309Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8140","description":"The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.","status":"published","published":"2017-01-30T21:59:00.91Z","modified":"2026-08-27T23:00:13.95885526Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"UBUNTU-CVE-2015-8140","description":"The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.","status":"published","published":"2017-01-30T21:59:00Z","modified":"2025-10-24T04:45:29Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"SUSE-SU-2016:1175-1","title":"Security update for ntp","description":"ntp was updated to version 4.2.8p6 to fix 12 security issues.\n\nThese security issues were fixed:\n- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).\n- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).\n- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).\n- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).\n- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).\n- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).\n- CVE-2015-7975: nextvar() missing length check (bsc#962988).\n- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).\n- CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).\n- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).\n- CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).\n\nThese non-security issues were fixed:\n- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP\n  (--enable-ntp-signd).  This replaces the w32 patches in 4.2.4 that added\n  the authreg directive.\n- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd.\n  When run as cron job, /usr/sbin/ is not in the path, which caused\n  the synchronization to fail.\n- bsc#782060: Speedup ntpq.\n- bsc#916617: Add /var/db/ntp-kod.\n- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.\n- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.\n- Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.\n- bsc#784760: Remove local clock from default configuration\n","status":"published","published":"2016-04-28T13:46:02Z","modified":"2026-02-04T02:57:39.769134Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1177-1","title":"Security update for ntp","description":"ntp was updated to version 4.2.8p6 to fix 12 security issues.\n\nAlso yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837)\n\nThese security issues were fixed:\n- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).\n- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).\n- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).\n- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).\n- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).\n- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).\n- CVE-2015-7975: nextvar() missing length check (bsc#962988).\n- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).\n- CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).\n- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).\n- CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).\n\nThese non-security issues were fixed:\n- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP\n  (--enable-ntp-signd).  This replaces the w32 patches in 4.2.4 that added\n  the authreg directive.\n- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd.\n  When run as cron job, /usr/sbin/ is not in the path, which caused\n  the synchronization to fail.\n- bsc#782060: Speedup ntpq.\n- bsc#916617: Add /var/db/ntp-kod.\n- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.\n- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.\n- Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.\n","status":"published","published":"2016-04-28T13:45:26Z","modified":"2026-02-04T04:14:10.491241Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1247-1","title":"Security update for ntp","description":"ntp was updated to version 4.2.8p6 to fix 28 security issues.\n\nMajor functional changes:\n- The 'sntp' commandline tool changed its option handling in a major way,\n  some options have been renamed or dropped.\n- 'controlkey 1' is added during update to ntp.conf to allow sntp to work.\n- The local clock is being disabled during update.\n- ntpd is no longer running chrooted.\n\nOther functional changes:\n- ntp-signd is installed.\n- 'enable mode7' can be added to the configuration to allow ntdpc to work as compatibility mode option.\n- 'kod' was removed from the default restrictions.\n- SHA1 keys are used by default instead of MD5 keys.\n\nAlso yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837)\n\nThese security issues were fixed:\n- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).\n- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).\n- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).\n- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).\n- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).\n- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).\n- CVE-2015-7975: nextvar() missing length check (bsc#962988).\n- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).\n- CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).\n- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).\n- CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).\n- CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608).\n- CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608).\n- CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608).\n- CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608).\n- CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608).\n- CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608).\n- CVE-2015-7850: remote config logfile-keyfile (bsc#951608).\n- CVE-2015-7849: trusted key use-after-free (bsc#951608).\n- CVE-2015-7848: mode 7 loop counter underrun (bsc#951608).\n- CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608).\n- CVE-2015-7703: configuration directives 'pidfile' and 'driftfile' should only be allowed locally (bsc#951608).\n- CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608).\n- CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608).\n\nThese non-security issues were fixed:\n- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd).\n  This replaces the w32 patches in 4.2.4 that added the authreg\n  directive.\n- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd.\n  When run as cron job, /usr/sbin/ is not in the path, which caused\n  the synchronization to fail.\n- bsc#782060: Speedup ntpq.\n- bsc#916617: Add /var/db/ntp-kod.\n- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.\n- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.\n- Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.\n- Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq.\n- bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution.\n- bsc#905885: Use SHA1 instead of MD5 for symmetric keys.\n- Improve runtime configuration:\n  * Read keytype from ntp.conf\n  * Don't write ntp keys to syslog.\n- Fix legacy action scripts to pass on command line arguments.\n- bsc#944300: Remove 'kod' from the restrict line in ntp.conf.\n- bsc#936327: Use ntpq instead of deprecated ntpdc in start-ntpd.\n- Add a controlkey to ntp.conf to make the above work.\n- Don't let 'keysdir' lines in ntp.conf trigger the 'keys' parser.\n- Disable mode 7 (ntpdc) again, now that we don't use it anymore.\n- Add 'addserver' as a new legacy action.\n- bsc#910063: Fix the comment regarding addserver in ntp.conf.\n- bsc#926510: Disable chroot by default.\n- bsc#920238: Enable ntpdc for backwards compatibility.\n","status":"published","published":"2016-05-06T07:50:51Z","modified":"2026-02-04T03:41:19.510535Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1311-1","title":"Security update for ntp","description":"\nThis network time protocol server ntp was updated to 4.2.8p6 to fix the following\nissues:\n\nAlso yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837)\n\nMajor functional changes:\n- The 'sntp' commandline tool changed its option handling in a major way.\n- 'controlkey 1' is added during update to ntp.conf to allow sntp to work.\n- The local clock is being disabled during update.\n- ntpd is no longer running chrooted.\n\n\nOther functional changes:\n- ntp-signd is installed.\n- 'enable mode7' can be added to the configuration to allow ntdpc to work as compatibility mode option.\n- 'kod' was removed from the default restrictions.\n- SHA1 keys are used by default instead of MD5 keys.\n\nThese security issues were fixed:\n- CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216).\n- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).\n- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).\n- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).\n- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).\n- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).\n- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).\n- CVE-2015-7975: nextvar() missing length check (bsc#962988).\n- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).\n- CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).\n- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).\n- CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).\n- CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608).\n- CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608).\n- CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608).\n- CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608).\n- CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608).\n- CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608).\n- CVE-2015-7850: remote config logfile-keyfile (bsc#951608).\n- CVE-2015-7849: trusted key use-after-free (bsc#951608).\n- CVE-2015-7848: mode 7 loop counter underrun (bsc#951608).\n- CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608).\n- CVE-2015-7703: configuration directives 'pidfile' and 'driftfile' should only be allowed locally (bsc#951608).\n- CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608).\n- CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608).\n\nThese non-security issues were fixed:\n- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd).\n  This replaces the w32 patches in 4.2.4 that added the authreg\n  directive.\n- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd.\n  When run as cron job, /usr/sbin/ is not in the path, which caused\n  the synchronization to fail.\n- bsc#782060: Speedup ntpq.\n- bsc#916617: Add /var/db/ntp-kod.\n- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.\n- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.\n- Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.\n- Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq.\n- bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution.\n- bsc#905885: Use SHA1 instead of MD5 for symmetric keys.\n- Improve runtime configuration:\n  * Read keytype from ntp.conf\n  * Don't write ntp keys to syslog.\n- Fix legacy action scripts to pass on command line arguments.\n- bsc#944300: Remove 'kod' from the restrict line in ntp.conf.\n- bsc#936327: Use ntpq instead of deprecated ntpdc in start-ntpd.\n- Don't let 'keysdir' lines in ntp.conf trigger the 'keys' parser.\n- Disable mode 7 (ntpdc) again, now that we don't use it anymore.\n- Add 'addserver' as a new legacy action.\n- bsc#910063: Fix the comment regarding addserver in ntp.conf.\n- bsc#926510: Disable chroot by default.\n- bsc#920238: Enable ntpdc for backwards compatibility.\n- bsc#784760: Remove local clock from default configuration.\n- bsc#942441/fate#319496: Require perl-Socket6.\n- Improve runtime configuration:\n  * Read keytype from ntp.conf\n  * Don't write ntp keys to syslog.\n- bsc#920183: Allow -4 and -6 address qualifiers in 'server' directives.\n- Use upstream ntp-wait, because our version is incompatible with\n  the new ntpq command line syntax.\n","status":"published","published":"2016-05-17T09:29:35Z","modified":"2026-02-04T04:38:27.911087Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:3193-1","title":"Security update for ntp","description":"\nThis update for ntp fixes the following issues:\n\n- Simplify ntpd's search for its own executable to prevent AppArmor\n  warnings (bsc#956365).\n\nSecurity issues fixed (update to 4.2.8p9):\n\n- CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6\n  unauthenticated trap information disclosure and DDoS vector.\n- CVE-2016-7427, bsc#1011390:\n  Broadcast Mode Replay Prevention DoS.\n- CVE-2016-7428, bsc#1011417:\n  Broadcast Mode Poll Interval Enforcement DoS.\n- CVE-2016-7431, bsc#1011395:\n  Regression: 010-origin: Zero Origin Timestamp Bypass.\n- CVE-2016-7434, bsc#1011398:\n  Null pointer dereference in _IO_str_init_static_internal().\n- CVE-2016-7429, bsc#1011404: Interface selection attack.\n- CVE-2016-7426, bsc#1011406:\n  Client rate limiting and server responses.\n- CVE-2016-7433, bsc#1011411: Reboot sync calculation problem.\n- CVE-2015-5219: An endless loop due to incorrect precision to\n  double conversion (bsc#943216).\n- CVE-2015-8140: ntpq vulnerable to replay attacks.\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin.\n- CVE-2015-5219: An endless loop due to incorrect precision to\n  double conversion (bsc#943216).\n\nNon-security issues fixed:\n\n- Fix a spurious error message.\n- Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog.\n- Fix a regression in 'trap' (bsc#981252).\n- Reduce the number of netlink groups to listen on for changes to\n  the local network setup (bsc#992606).\n- Fix segfault in 'sntp -a' (bsc#1009434).\n- Silence an OpenSSL version warning (bsc#992038).\n- Make the resolver task change user and group IDs to the same\n  values as the main task. (bsc#988028)\n\n","status":"published","published":"2016-12-19T16:07:30Z","modified":"2026-02-04T03:40:02.425004Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0255-1","title":"Security update for ntp","description":"\nThis update for ntp fixes the following issues:\n\nntp was updated to 4.2.8p9.\n\nSecurity issues fixed:\n\n- CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6\n  unauthenticated trap information disclosure and DDoS vector.\n- CVE-2016-7427, bsc#1011390:\n  Broadcast Mode Replay Prevention DoS.\n- CVE-2016-7428, bsc#1011417:\n  Broadcast Mode Poll Interval Enforcement DoS.\n- CVE-2016-7431, bsc#1011395:\n  Regression: 010-origin: Zero Origin Timestamp Bypass.\n- CVE-2016-7434, bsc#1011398:\n  Null pointer dereference in _IO_str_init_static_internal().\n- CVE-2016-7429, bsc#1011404: Interface selection attack.\n- CVE-2016-7426, bsc#1011406:\n  Client rate limiting and server responses.\n- CVE-2016-7433, bsc#1011411: Reboot sync calculation problem.\n- CVE-2015-8140: ntpq vulnerable to replay attacks.\n- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin.\n- CVE-2015-5219: An endless loop due to incorrect precision to\n  double conversion (bsc#943216).\n\nNon-security issues fixed:\n\n- Fix a spurious error message.\n- Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog.\n- Fix a regression in 'trap' (bsc#981252).\n- Reduce the number of netlink groups to listen on for changes to\n  the local network setup (bsc#992606).\n- Fix segfault in 'sntp -a' (bsc#1009434).\n- Silence an OpenSSL version warning (bsc#992038).\n- Make the resolver task change user and group IDs to the same\n  values as the main task. (bsc#988028)\n- Simplify ntpd's search for its own executable to prevent AppArmor\n  warnings (bsc#956365).\n\n","status":"published","published":"2017-01-23T11:27:30Z","modified":"2026-02-04T03:28:16.725221Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}