Bug 1274184 - (CVE-2015-7705) CVE-2015-7705 ntp: denial of service by trigerring rate limiting on NTP server
CVE-2015-7705 ntp: denial of service by trigerring rate limiting on NTP server
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 1296166
Blocks: 1260670
  Show dependency treegraph
Reported: 2015-10-22 04:16 EDT by Martin Prpič
Modified: 2016-05-09 21:54 EDT (History)
6 users (show)

See Also:
Fixed In Version: ntp 4.2.8p4
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2016-01-07 08:32:23 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Martin Prpič 2015-10-22 04:16:59 EDT
A flaw was found in the way NTP handled rate limiting. An attacker able to send a large number of crafted requests to an NTP server could trigger the rate limiting on that server, and prevent clients from getting a usable reply from the server.

The default NTP configuration in Red Hat Enterprise Linux does not enable rate limiting.

External References:

Comment 4 Martin Prpič 2016-01-06 08:57:24 EST
Created ntp tracking bugs for this issue:

Affects: fedora-all [bug 1296166]
Comment 6 Martin Prpič 2016-01-07 08:32:23 EST
While mitigating this particular issue by adding a log message into the log files, the upstream fix may have inadvertently introduced a new issue that could fill up all log files.

The correct fix for this issue is randomized response rate limiting. However, implementing this issue would radically change the way limiting works in NTP and could potentially break other application's functionality relying on this feature currently.

An additional, less intrusive fix for this issue may be developed at a later time and included in later releases of Red Hat Enterprise Linux.

Rate limiting is by default disabled in the ntp packages shipped in Red Hat Enterprise Linux. To specifically disable rate limiting, use the following workaround.


Do not add the "limited" configuration option to any restrict lines in the ntp.conf file.

Note You need to log in before you can comment on or make changes to this bug.