Published: 13/01/2017 Updated: 18/06/2020

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

NTP prior to 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote malicious users to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ntp ntp 4.2.5
ntp ntp
ntp ntp 4.2.8
canonical ubuntu linux 12.04
redhat enterprise linux desktop 6.0
redhat enterprise linux desktop 7.0
redhat enterprise linux server 6.0
redhat enterprise linux server 7.0
redhat enterprise linux server aus 7.3
redhat enterprise linux server aus 7.4
redhat enterprise linux server aus 7.6
redhat enterprise linux server aus 7.7
redhat enterprise linux server eus 7.3
redhat enterprise linux server eus 7.4
redhat enterprise linux server eus 7.5
redhat enterprise linux server eus 7.6
redhat enterprise linux server eus 7.7
redhat enterprise linux server tus 7.3
redhat enterprise linux server tus 7.6
redhat enterprise linux server tus 7.7
redhat enterprise linux workstation 6.0
redhat enterprise linux workstation 7.0
hpe hpux-ntp

Synopsis Moderate: ntp security update Type/Severity Security Advisory: Moderate Topic An update for ntp is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Syste ...

Several security issues were fixed in NTP ...

Ephemeral association time spoofing additional protectionntpd in ntp 42x before 428p7 and 43x before 4392 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack This issue exists because of an ...

The following security-related issues were resolved: CVE-2016-7426: Client rate limiting and server responsesCVE-2016-7429: Attack on interface selectionCVE-2016-7433: Broken initial sync calculations regressionCVE-2016-9310: Mode 6 unauthenticated trap information disclosure and DDoS vectorCVE-2016-9311: Null pointer dereference when trap service ...

It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid responses from its sources ...

When ntpd is configured with rate limiting for all associations (restrict default limited in ntpconf), the limits are applied also to responses received from its configured sources An attacker who knows the sources (eg, from an IPv4 refid in server response) and knows the system is (mis)configured in this way can periodically send packets with ...

CWE-400 https://www.kb.cert.org/vuls/id/633847 http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities http://support.ntp.org/bin/view/Main/NtpBug3071 http://nwtime.org/ntp428p9_release/http://www.securityfocus.com/bid/94451 https://bto.bluecoat.com/security-advisory/sa139 https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03706en_us http://www.securitytracker.com/id/1037354 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc http://rhn.redhat.com/errata/RHSA-2017-0252.html https://usn.ubuntu.com/3707-2/https://access.redhat.com/errata/RHSA-2017:0252 https://nvd.nist.gov https://usn.ubuntu.com/3707-2/https://www.kb.cert.org/vuls/id/633847

CVE-2016-7426

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect