CVE-2015-7705: citrix xenserver Improper Input Validation

CVSS: 9.8v3.1CriticalModified

AliasesUBUNTU-CVE-2015-7705DEBIAN-CVE-2015-7705

Published 07-08-2017Last modified 06-08-2024

Vulnerability summary

CVE-2015-7705 is a critical (CVSS 9.8) Improper Input Validation vulnerability in citrix xenserver. EPSS estimates a 12.15% chance of exploitation in the next 30 days, higher than 96.1% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

12.15%

0%100%

Medium · -0.20 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 9

OPENSUSE-SU-2024:10181-1 SUSE-SU-2015:2058-1 SUSE-SU-2016:1247-1 SUSE-SU-2016:1278-1 SUSE-SU-2016:1291-1 SUSE-SU-2016:1311-1+3 more

Timeline

07-08-2017
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.

CVSS metrics

5 scores · 3 sources · 3 versions

v3.19.8v3.09.8v2.07.5

EPSS trend

Probability

12.15%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

-0.20 pp

From 12.35% on 18-09-2026

18-09-202618-10-2026

EPSS score

12.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Netapp4 products

Citrix1 product

xenserver6.0.2 | 6.2.0 | 6.5 | 7.0

Debian1 product

ntp< 1:4.2.8p4+dfsg-3

Ntp1 product

ntp≥ 4.2.0, < 4.2.8 | ≥ 4.3.0, < 4.3.77 | 4.2.8 | 4.2.8:p1 | 4.2.8:p1-beta1 | 4.2.8:p1-beta2 | 4.2.8:p1-beta3 | 4.2.8:p1-beta4 | 4.2.8:p1-beta5 | 4.2.8:p1-rc1 | 4.2.8:p1-rc2 | 4.2.8:p2 | 4.2.8:p2-rc1 | 4.2.8:p2-rc2 | 4.2.8:p2-rc3 | 4.2.8:p3 | 4.2.8:p3-rc1 | 4.2.8:p3-rc2 | 4.2.8:p3-rc3

Ubuntu1 product

ntp< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5

5 vendors · 8 products

References

42 links

lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.htmlVendor AdvisoryX Refsource SUSE
www.kb.cert.org/vuls/id/718152Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.ubuntu.com/usn/USN-2783-1Vendor AdvisoryX Refsource UBUNTU
lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.htmlVendor AdvisoryX Refsource SUSE
www.securityfocus.com/bid/77284VDB EntryX Refsource BIDThird Party Advisory
support.citrix.com/article/CTX220112X Refsource CONFIRMThird Party Advisory
www.securitytracker.com/id/1033951VDB EntryX Refsource SECTRACKThird Party Advisory
support.ntp.org/bin/view/Main/SecurityNoticeX Refsource CONFIRMRelease NotesVendor Advisory
lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.htmlVendor AdvisoryX Refsource SUSE
www.cs.bu.edu/~goldbe/NTPattack.htmlX Refsource MISCNot Applicable

Show all 42 references

lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.htmlVendor AdvisoryX Refsource SUSE
eprint.iacr.org/2015/1020.pdfX Refsource MISCTechnical Description
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05270839X Refsource CONFIRMThird Party AdvisoryVDB Entry
bugzilla.redhat.com/show_bug.cgi?id=1274184X Refsource CONFIRMIssue TrackingThird Party AdvisoryVDB Entry
support.ntp.org/bin/view/Main/NtpBug2901X Refsource CONFIRMVendor Advisory
lists.opensuse.org/opensuse-updates/2016-05/msg00114.htmlVendor AdvisoryX Refsource SUSE
security.gentoo.org/glsa/201607-15Vendor AdvisoryX Refsource GENTOOThird Party AdvisoryVDB Entry
security.netapp.com/advisory/ntap-20171004-0001/X Refsource CONFIRMThird Party Advisory
packetstormsecurity.com/files/134137/Slackware-Security-Advisory-ntp-Updates.htmlX Refsource MISC
lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.htmlVendor AdvisoryX Refsource SUSE
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-ntpVendor AdvisoryX Refsource CISCO
lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.htmlVendor AdvisoryX Refsource SUSE
bto.bluecoat.com/security-advisory/sa103X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-updates/2015-11/msg00093.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.htmlVendor AdvisoryX Refsource SUSE
www.securityfocus.com/archive/1/536796/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/archive/1/archive/1/536796/100/100/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/archive/1/536737/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/archive/1/archive/1/536737/100/100/threadedMailing ListX Refsource BUGTRAQ
cert-portal.siemens.com/productcert/pdf/ssa-497656.pdfX Refsource CONFIRMThird Party Advisory
us-cert.cisa.gov/ics/advisories/icsa-21-103-11X Refsource MISCThird Party AdvisoryUS Government Resource
cert-portal.siemens.com/productcert/pdf/ssa-211752.pdfX Refsource CONFIRM
us-cert.cisa.gov/ics/advisories/icsa-21-159-11X Refsource MISC
www.arista.com/en/support/advisories-notices/security-advisories/1212-security-advisory-0016X Refsource MISC
ubuntu.com/security/CVE-2015-7705REPORT
support.ntp.org/bin/view/Main/SecurityNoticeREPORT
www.cs.bu.edu/~goldbe/NTPattack.htmlREPORT
ubuntu.com/security/notices/USN-2783-1Advisory
www.cve.org/CVERecord?id=CVE-2015-7705REPORT
security-tracker.debian.org/tracker/CVE-2015-7705Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities