CVE-2016-2518 The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.
MediumCVSS 5.3
EPSS 15.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ntp(Debian:11) | < 1:4.2.8p7+dfsg-1 | 1:4.2.8p7+dfsg-1 |
| ntp | < 4.2.8 | 4.2.8 |
| ntp | >= 4.3.0, < 4.3.92 | 4.3.92 |
| ntp | = 4.2.8 | No fix listed |
| ntp | = 4.2.8-p1 | No fix listed |
| ntp | = 4.2.8-p1-beta1 | No fix listed |
| ntp | = 4.2.8-p1-beta2 | No fix listed |
| ntp | = 4.2.8-p1-beta3 | No fix listed |
| ntp | = 4.2.8-p1-beta4 | No fix listed |
| ntp | = 4.2.8-p1-beta5 | No fix listed |
| ntp | = 4.2.8-p1-rc1 | No fix listed |
| ntp | = 4.2.8-p1-rc2 | No fix listed |
| ntp | = 4.2.8-p2 | No fix listed |
| ntp | = 4.2.8-p2-rc1 | No fix listed |
| ntp | = 4.2.8-p2-rc2 | No fix listed |
| ntp | = 4.2.8-p2-rc3 | No fix listed |
| ntp | = 4.2.8-p3 | No fix listed |
| ntp | = 4.2.8-p3-rc1 | No fix listed |
| ntp | = 4.2.8-p3-rc2 | No fix listed |
| ntp | = 4.2.8-p3-rc3 | No fix listed |
| ntp | = 4.2.8-p4 | No fix listed |
| ntp | = 4.2.8-p5 | No fix listed |
| ntp | = 4.2.8-p6 | No fix listed |
| ntp | = 4.2.8-p7 | No fix listed |
| ntp | = 4.2.8-p8 | No fix listed |
Show 100 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
| netapp clustered data ontap | All versions | No fix listed |
| netapp data ontap | All versions | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| netapp oncommand performance manager | All versions | No fix listed |
| netapp oncommand unified manager for clustered data ontap | All versions | No fix listed |
| oracle communications user data repository | = 10.0.0 | No fix listed |
| oracle communications user data repository | = 10.0.1 | No fix listed |
| oracle communications user data repository | = 12.0.0 | No fix listed |
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.2 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.2 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 7.2 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| freebsd | = 9.3 | No fix listed |
| freebsd | = 9.3-p1 | No fix listed |
| freebsd | = 9.3-p10 | No fix listed |
| freebsd | = 9.3-p12 | No fix listed |
| freebsd | = 9.3-p13 | No fix listed |
| freebsd | = 9.3-p16 | No fix listed |
| freebsd | = 9.3-p19 | No fix listed |
| freebsd | = 9.3-p2 | No fix listed |
| freebsd | = 9.3-p20 | No fix listed |
| freebsd | = 9.3-p21 | No fix listed |
| freebsd | = 9.3-p22 | No fix listed |
| freebsd | = 9.3-p23 | No fix listed |
| freebsd | = 9.3-p24 | No fix listed |
| freebsd | = 9.3-p25 | No fix listed |
| freebsd | = 9.3-p28 | No fix listed |
| freebsd | = 9.3-p3 | No fix listed |
| freebsd | = 9.3-p30 | No fix listed |
| freebsd | = 9.3-p31 | No fix listed |
| freebsd | = 9.3-p32 | No fix listed |
| freebsd | = 9.3-p33 | No fix listed |
| freebsd | = 9.3-p34 | No fix listed |
| freebsd | = 9.3-p35 | No fix listed |
| freebsd | = 9.3-p36 | No fix listed |
| freebsd | = 9.3-p38 | No fix listed |
| freebsd | = 9.3-p39 | No fix listed |
| freebsd | = 9.3-p5 | No fix listed |
| freebsd | = 9.3-p6 | No fix listed |
| freebsd | = 9.3-p7 | No fix listed |
| freebsd | = 9.3-p8 | No fix listed |
| freebsd | = 9.3-p9 | No fix listed |
| freebsd | = 10.1 | No fix listed |
| freebsd | = 10.1-p1 | No fix listed |
| freebsd | = 10.1-p10 | No fix listed |
| freebsd | = 10.1-p12 | No fix listed |
| freebsd | = 10.1-p15 | No fix listed |
| freebsd | = 10.1-p16 | No fix listed |
| freebsd | = 10.1-p17 | No fix listed |
| freebsd | = 10.1-p18 | No fix listed |
| freebsd | = 10.1-p19 | No fix listed |
| freebsd | = 10.1-p2 | No fix listed |
| freebsd | = 10.1-p22 | No fix listed |
| freebsd | = 10.1-p24 | No fix listed |
| freebsd | = 10.1-p25 | No fix listed |
| freebsd | = 10.1-p26 | No fix listed |
| freebsd | = 10.1-p27 | No fix listed |
| freebsd | = 10.1-p28 | No fix listed |
| freebsd | = 10.1-p29 | No fix listed |
| freebsd | = 10.1-p3 | No fix listed |
| freebsd | = 10.1-p30 | No fix listed |
| freebsd | = 10.1-p31 | No fix listed |
| freebsd | = 10.1-p4 | No fix listed |
| freebsd | = 10.1-p5 | No fix listed |
| freebsd | = 10.1-p6 | No fix listed |
| freebsd | = 10.1-p7 | No fix listed |
| freebsd | = 10.1-p8 | No fix listed |
| freebsd | = 10.1-p9 | No fix listed |
| freebsd | = 10.2 | No fix listed |
| freebsd | = 10.2-p1 | No fix listed |
| freebsd | = 10.2-p10 | No fix listed |
| freebsd | = 10.2-p11 | No fix listed |
| freebsd | = 10.2-p12 | No fix listed |
| freebsd | = 10.2-p13 | No fix listed |
| freebsd | = 10.2-p14 | No fix listed |
| freebsd | = 10.2-p2 | No fix listed |
| freebsd | = 10.2-p5 | No fix listed |
| freebsd | = 10.2-p7 | No fix listed |
| freebsd | = 10.2-p8 | No fix listed |
| freebsd | = 10.2-p9 | No fix listed |
| freebsd | = 10.3 | No fix listed |
| Siemens simatic net cp 443-1 opc ua firmware | All versions | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- FEDORA-2016-ed8c6c0426 vendor-advisory
- FEDORA-2016-5b2eb0bf9c vendor-advisory
- SUSE-SU-2016:1278 vendor-advisory
- SUSE-SU-2016:1291 vendor-advisory
- openSUSE-SU-2016:1329 vendor-advisory
- SUSE-SU-2016:1471 vendor-advisory
- SUSE-SU-2016:1568 vendor-advisory
- SUSE-SU-2016:1912 vendor-advisory
- SUSE-SU-2016:2094 vendor-advisory
- openSUSE-SU-2016:1423 vendor-advisory
- packetstormsecurity.com
- RHSA-2016:1552 broken-link vendor-advisory
- support.ntp.org vendor-advisory
- support.ntp.org vendor-advisory
- 20160428 Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: April 2016 vendor-advisory
- DSA-3629 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 20160429 [slackware-security] ntp (SSA:2016-120-01) mailing-list
- 20160429 [slackware-security] ntp (SSA:2016-120-01) mailing-list
- 88226 third-party-advisory vdb-entry
- 1035705 third-party-advisory vdb-entry
- USN-3096-1 vendor-advisory
- RHSA-2016:1141 third-party-advisory vendor-advisory
- cert-portal.siemens.com third-party-advisory
- FreeBSD-SA-16:16 third-party-advisory vendor-advisory
- GLSA-201607-15 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- support.f5.com
- us-cert.cisa.gov
- DSA-3629 vendor-advisory
- VU#718152 third-party-advisory us-government-resource