CVE-2015-8140 json
The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.
published 2017-01-30 9 y ago modified 2026-06-17 4 mo ago also EUVD-2015-8030
- cvss
- 4.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.6%
- EPSS 4.6% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.
Patch / fix
- ntp Debian 11 1:4.2.8p7+dfsg-1
debian advisories DEBIAN-CVE-2015-8140
- ntp SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLES 11 SP2-LTSS +4 more 4.2.8p9-48.9.1
- ntp SLES for SAP 11 SP4, SLES 11 SP4 4.2.8p9-57.2
- ntp SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLES 11 SP2-LTSS +3 more 4.2.8p6-41.1
- ntp SLES for SAP 12, SLES 12, SLED 12 4.2.8p6-46.5.2
- yast2-ntp-client SLES for SAP 12, SLES 12, SLED 12 +1 more 3.1.12.4-8.2
- ntp SLES 12 SP1, SLES 11 SP4, SLED 12 SP1 +2 more 4.2.8p6-8.2
- yast2-ntp-client SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 3.1.22-6.2
- yast2-ntp-client SLES 11 SP2-LTSS 2.17.14.1-1.12.1
suse advisories SUSE-SU-2017:0255-1SUSE-SU-2016:3193-1SUSE-SU-2016:1311-1SUSE-SU-2016:1247-1SUSE-SU-2016:1175-1SUSE-SU-2016:1177-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2015-8140 updated cvss 5.4
ntp: ntpq protocol vulnerable to replay attacks
-
Red Hat Enterprise Linux 5 ntp Red Hat Enterprise Linux 6 ntp, ntpdate, ntp-perl Red Hat Enterprise Linux 7 ntp, sntp, ntpdate, ntp-perlaffected: workaround, no fix planned “Will not fix”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
4.62% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 4.8 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:N/I:P/A:P |
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-04/msg00060.html
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-05/msg00038.html
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-05/msg00020.html
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-05/msg00048.html
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-04/msg00059.html
vendor-advisory, third-party-advisory
-
security.freebsd.org
/advisories/FreeBSD-SA-16:09.ntp.asc
vendor-advisory
-
lists.opensuse.org
/opensuse-updates/2016-05/msg00114.html
vendor-advisory, third-party-advisory
-
security.gentoo.org
/glsa/201607-15
vendor-advisory, third-party-advisory
-
support.ntp.org
/bin/view/Main/NtpBug2947
vendor-advisory
-
securitytracker.com
/id/1034782
vdb-entry, third-party-advisory
-
kb.cert.org
/vuls/id/718152
third-party-advisory, us-government-resource
-
bto.bluecoat.com
/security-advisory/sa113
third-party-advisory
- security.netapp.com /advisory/ntap-20200204-0003/
Sources
- CVE List CVE-2015-8140
- NVD CVE-2015-8140
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.