CVE-2015-7871
CriticalCrypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
Published Aug 7, 2017 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2015-7871, UBUNTU-CVE-2015-7871
Key Facts
Patch immediately- CVE-2015-7871 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Oncommand Balance (Netapp), Oncommand Performance Manager (Netapp), Oncommand Unified Manager (Netapp) and 12 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 82% probability of exploitation in the next 30 days.
- Fixed versions are available, including Ntp 1:4.2.6.p2+dfsg-1+deb6u4, Ntp 1:4.2.6.p5+dfsg-2+deb7u6, Ntp 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
82%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2015-7871 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
Affected Products
158 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Oncommand BalanceNetapp | See advisory | n/a |
| Oncommand Performance ManagerNetapp | See advisory | n/a |
| Oncommand Unified ManagerNetapp | See advisory | n/a |
| NtpNtp | 4.2.5-p186, 4.2.5-p187, 4.2.5-p188, 4.2.5-p189, 4.2.5-p190, 4.2.5-p191, 4.2.5-p192, 4.2.5-p193 | 4.2.8 |
| Debian LinuxDebian | 7.0, 8.0, 9.0 | n/a |
Patched Releases
Ntp
1:4.2.6.p2+dfsg-1+deb6u4, 1:4.2.6.p5+dfsg-2+deb7u6, 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5, 1:4.2.6.p5+dfsg-7+deb8u1, 1:4.2.8p4+dfsg-1, 4.2.6p5-34.27.amzn1, 4.2.8p4-5.1, 4.2.8p4-9.2, 4.2.8p6-41.1, 4.2.8p6-46.5.2, 4.2.8p7-25.15.1, 4.2.8p9-1.1, NA, 4.2.8
ntp-debuginfo
4.2.8p7-25.15.1
ntp-debugsource
4.2.8p7-25.15.1
ntp-doc
4.2.6p5-34.27.amzn1, 4.2.8p4-5.1, 4.2.8p4-9.2, 4.2.8p6-41.1, 4.2.8p6-46.5.2, 4.2.8p7-25.15.1, 4.2.8p9-1.1
ntp-perl
4.2.6p5-34.27.amzn1, NA
ntpdate
4.2.6p5-34.27.amzn1
ntpstat
NA
yast2-ntp-client
2.17.14.1-1.12.1, 3.1.12.4-8.2
yast2-ntp-client-devel-doc
3.1.12.4-8.2
Timeline
Publicly disclosed
Aug 7, 2017
Last updated
Aug 4, 2026
Weakness Type
- CWE-287 Improper Authentication
- CWE-305 Authentication Bypass by Primary Weakness
References
- advisoryhttp://blog.talosintel.com/2015/10/ntpd-vulnerabilities.html
- advisoryhttps://bugzilla.redhat.com/show_bug.cgi?id=1274265
- advisoryhttps://bugzilla.suse.com/782060
- advisoryhttps://bugzilla.suse.com/784760
- advisoryhttps://bugzilla.suse.com/905885
FAQ
Common Questions.
Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
Affected: Oncommand Balance (Netapp); Oncommand Performance Manager (Netapp); Oncommand Unified Manager (Netapp), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Ntp 1:4.2.6.p2+dfsg-1+deb6u4, Ntp 1:4.2.6.p5+dfsg-2+deb7u6, Ntp 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2015-7871 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo