VYPR
← All advisories
Medium severity5.9NVD Advisory· Published Jan 30, 2017· Updated May 13, 2026

CVE-2015-8158

CVE-2015-8158

Description

The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect values.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The getresponse function in ntpq before NTP 4.2.8p6 can loop infinitely when processing crafted packets, causing denial of service.

Vulnerability

The getresponse function in ntpq processes incoming packets in a loop. The loop only terminates on a complete correct response or a few specific error conditions. If a crafted packet contains incorrect values that do not trigger any error condition, the loop continues indefinitely, causing an infinite loop. This affects NTP versions prior to 4.2.8p6 and 4.3.x prior to 4.3.90 [4]. Note that this is an attack against ntpq, not ntpd.

Exploitation

An attacker can trigger the infinite loop by sending crafted packets to an ntpq client. The attacker must either own a malicious NTP server that the client trusts, prevent the legitimate server from sending packets to the client, or perform a man-in-the-middle (MITM) attack on the ntpq communication [4]. No authentication is required, but the attacker must have network access to the client and be able to send packets with incorrect values.

Impact

Successful exploitation causes a denial of service (DoS) through an infinite loop, consuming client resources and rendering ntpq unresponsive. There is no impact on confidentiality or integrity, and the CVSS v3 score is 5.9 (medium) [4].

Mitigation

Upgrade to NTP 4.2.8p6 or later, or to 4.3.90 or later [4]. Updated packages are available for various distributions, such as Red Hat Enterprise Linux [1] and FreeBSD [2]. If an upgrade is not immediately possible, restrict network access to ntpq clients and only use them against trusted NTP servers.

References
  1. http://rhn.redhat.com/errata/RHSA-2016-2583.html
  2. https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc
  3. NTP BUG 2948: Potential Infinite Loop in ntpq

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

115

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.