PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-7979 Ntp CVE debrief

CVE-2015-7979 is a network-reachable denial-of-service issue in NTP broadcast-client handling. According to the NVD record, a remote attacker can send broadcast packets with invalid authentication and trigger client-server association tear down, disrupting time synchronization service without impacting confidentiality or integrity.

Vendor
Ntp
Product
CVE-2015-7979
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-30
Original CVE updated
2026-05-13
Advisory published
2017-01-30
Advisory updated
2026-05-13

Who should care

Administrators of systems running affected NTP releases, especially servers or appliances that use NTP broadcast client mode, should prioritize this because it can interrupt a core infrastructure service over the network.

Technical summary

The NVD description states that NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service by sending broadcast packets with invalid authentication to a broadcast client. The CVSS vector in the record is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, and the assigned weakness is CWE-19.

Defensive priority

High. This is an unauthenticated network DoS against a foundational time-synchronization component, so exposed broadcast-client deployments should be remediated promptly.

Recommended defensive actions

  • Upgrade NTP to a fixed release at or above 4.2.8p6 or 4.3.90, using vendor-supported packages for your platform.
  • Confirm whether any hosts are configured as NTP broadcast clients; if not required, disable broadcast-client usage to reduce exposure.
  • Review vendor and distribution security advisories for the affected platform and apply the matching package updates.
  • Monitor NTP service health after remediation to verify associations remain stable and time synchronization is restored.

Evidence notes

The core facts come from the official NVD record and the CVE record. NVD describes remote denial of service via invalidly authenticated broadcast packets against a broadcast client, and the CVSS vector shows network access, no privileges, no user interaction, and high availability impact. The reference list in the source corpus also includes multiple 2016 vendor and distribution advisories, which is consistent with fixes being available before the NVD record was published.

Official resources

The NVD record was published on 2017-01-30 and last modified on 2026-05-13. The source corpus references show vendor and downstream advisories from 2016, so remediation guidance was available before the NVD publication date.