What’s Vulnerable › Vulnerabilities

CVE-2015-7848

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-01-06 · updated 2026-06-17
• Weakness: CWE-190

Description

An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash.

Affected products

• Clustered Data ONTAP: all versions
• NetApp Data Ontap Operating In 7-Mode: all versions
• NetApp Oncommand Balance: all versions
• NetApp Oncommand Performance Manager: all versions
• NetApp OnCommand Unified Manager for 7-Mode (core package): all versions
• NTP: from 4.0 before 4.2.8; from 4.3.0 before 4.3.77; 4.2.8, 4.2.8-p1, 4.2.8-p1-beta1, 4.2.8-p1-beta2, 4.2.8-p1-beta3, 4.2.8-p1-beta4 (+11) — fixed in 4.2.8, 4.3.77

How to fix

Upgrade to a fixed version: NTP 4.2.8, 4.3.77. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/77275
• http://www.securitytracker.com/id/1033951
• http://www.talosintelligence.com/reports/TALOS-2015-0052/
• https://security.gentoo.org/glsa/201607-15
• https://security.netapp.com/advisory/ntap-20171004-0001/
• http://www.securityfocus.com/bid/77275
• http://www.securitytracker.com/id/1033951
• http://www.talosintelligence.com/reports/TALOS-2015-0052/
• https://security.gentoo.org/glsa/201607-15
• https://security.netapp.com/advisory/ntap-20171004-0001/

Get alerted when CVE-2015-7848 or the next vulnerability affects your stack