Published: 05/07/2016 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Subscribe to Ntp

The process_packet function in ntp_proto.c in ntpd in NTP 4.x prior to 4.2.8p8 allows remote malicious users to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ntp ntp 4.2.8
ntp ntp
oracle solaris 11.3
oracle solaris 10
suse linux enterprise server 11
suse openstack cloud 5
suse manager proxy 2.1
suse manager 2.1
suse linux enterprise server 12
suse linux enterprise desktop 12
opensuse leap 42.1
opensuse opensuse 13.2
siemens simatic_net_cp_443-1_opc_ua_firmware
siemens tim_4r-ie_firmware
siemens tim_4r-ie_dnp3_firmware

Several security issues were fixed in NTP ...

It was discovered that ntpq and ntpdc disclosed the origin timestamp to unauthenticated clients, which could permit such clients to forge the server's replies (CVE-2015-8139) The process_packet function in ntp_protoc in ntpd in NTP 4x before 428p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoo ...

The process_packet function in ntp_protoc in ntpd in NTP 4x before 428p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication ...

CWE-362 http://www.kb.cert.org/vuls/id/321640 http://bugs.ntp.org/3044 http://support.ntp.org/bin/view/Main/NtpBug3044 http://support.ntp.org/bin/view/Main/SecurityNotice http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03757en_us https://security.gentoo.org/glsa/201607-15 http://www.securitytracker.com/id/1036037 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:24.ntp.asc https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11 https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf http://www.securityfocus.com/archive/1/archive/1/538600/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/538599/100/0/threaded http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html http://www.ubuntu.com/usn/USN-3096-1 http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html http://www.securityfocus.com/archive/1/archive/1/540683/100/0/threaded http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html http://www.securityfocus.com/archive/1/538599/100/0/threaded http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ntpd http://www.securityfocus.com/archive/1/538600/100/0/threaded https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11 http://www.securityfocus.com/archive/1/540683/100/0/threaded https://www.kb.cert.org/vuls/id/321640 http://packetstormsecurity.com/files/137321/Slackware-Security-Advisory-ntp-Updates.html http://packetstormsecurity.com/files/137322/FreeBSD-Security-Advisory-FreeBSD-SA-16-24.ntp.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNWGCQLW2VY72NIUYMJOCAKJKTXHDUK2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORAMN3Q7TVJ54MBYF75XCJOE3DP7LYHT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3EYJQHJZ2KTVQ7ICEFHXTLZ36MRASWX/https://usn.ubuntu.com/3096-1/https://nvd.nist.gov https://www.kb.cert.org/vuls/id/321640

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook