PublicDateAtUSN: 2015-10-22
Candidate: CVE-2015-7704
PublicDate: 2017-08-07 20:29:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7704
 http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner
 http://www.cs.bu.edu/~goldbe/NTPattack.html
 https://ubuntu.com/security/notices/USN-2783-1
Description:
 The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows
 remote attackers to cause a denial of service via a number of crafted "KOD"
 messages.
Ubuntu-Description: 
Notes: 
 mdeslaur> fix is bad, see http://lists.ntp.org/pipermail/pool/2015-October/007631.html
Bugs: 
 http://bugs.ntp.org/show_bug.cgi?id=2901
 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7704
Priority: medium
Discovered-by: Aanchal Malhotra, Issac E. Cohen, and Sharon Goldberg
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_ntp:
 upstream: https://github.com/ntp-project/ntp/commit/21d57dc336dbe9a975baca5ce5ae4da5b71ff123
 upstream: https://github.com/ntp-project/ntp/commit/492758c3d0690d3ccf7130fabfcf670997f12f7b
 upstream: https://github.com/ntp-project/ntp/commit/06b143c07c7be5a54608180f69ec06b317e0aac5
upstream_ntp: needs-triage
precise_ntp: released (1:4.2.6.p3+dfsg-1ubuntu3.6)
trusty_ntp: released (1:4.2.6.p5+dfsg-3ubuntu2.14.04.5)
trusty/esm_ntp: released (1:4.2.6.p5+dfsg-3ubuntu2.14.04.5)
vivid_ntp: released (1:4.2.6.p5+dfsg-3ubuntu6.2)
wily_ntp: released (1:4.2.6.p5+dfsg-3ubuntu8.1)
devel_ntp: released (1:4.2.6.p5+dfsg-3ubuntu8.1)
vivid/stable-phone-overlay_ntp: released (1:4.2.6.p5+dfsg-3ubuntu6.2)
vivid/ubuntu-core_ntp: DNE