CVE-2016-4955 ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet...
MediumCVSS 5.9
EPSS 8.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ntp(Debian:11) | < 1:4.2.8p8+dfsg-1 | 1:4.2.8p8+dfsg-1 |
| ntp | >= 4.2.0, < 4.2.8 | 4.2.8 |
| ntp | >= 4.3.0, < 4.3.93 | 4.3.93 |
| ntp | = 4.2.8 | No fix listed |
| ntp | = 4.2.8-p1 | No fix listed |
| ntp | = 4.2.8-p1-beta1 | No fix listed |
| ntp | = 4.2.8-p1-beta2 | No fix listed |
| ntp | = 4.2.8-p1-beta3 | No fix listed |
| ntp | = 4.2.8-p1-beta4 | No fix listed |
| ntp | = 4.2.8-p1-beta5 | No fix listed |
| ntp | = 4.2.8-p1-rc1 | No fix listed |
| ntp | = 4.2.8-p1-rc2 | No fix listed |
| ntp | = 4.2.8-p2 | No fix listed |
| ntp | = 4.2.8-p2-rc1 | No fix listed |
| ntp | = 4.2.8-p2-rc2 | No fix listed |
| ntp | = 4.2.8-p2-rc3 | No fix listed |
| ntp | = 4.2.8-p3 | No fix listed |
| ntp | = 4.2.8-p3-rc1 | No fix listed |
| ntp | = 4.2.8-p3-rc2 | No fix listed |
| ntp | = 4.2.8-p3-rc3 | No fix listed |
| ntp | = 4.2.8-p4 | No fix listed |
| ntp | = 4.2.8-p5 | No fix listed |
| ntp | = 4.2.8-p6 | No fix listed |
| ntp | = 4.2.8-p7 | No fix listed |
| oracle solaris | = 10 | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle solaris | = 11.3 | No fix listed |
| SUSE manager proxy | = 2.1 | No fix listed |
| SUSE openstack cloud | = 5 | No fix listed |
| novell suse manager | = 2.1 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| SUSE linux enterprise desktop | = 12-sp1 | No fix listed |
| SUSE linux enterprise server | = 11-sp2 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp4 | No fix listed |
| SUSE linux enterprise server | = 12-sp1 | No fix listed |
| Siemens simatic net cp 443-1 opc ua firmware | All versions | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- bugs.ntp.org issue-tracking vendor-advisory
- SUSE-SU-2016:1563 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1568 vendor-advisory
- openSUSE-SU-2016:1583 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1584 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1602 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:1636 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1912 vendor-advisory
- SUSE-SU-2016:2094 vendor-advisory
- packetstormsecurity.com
- packetstormsecurity.com
- support.ntp.org patch vendor-advisory
- support.ntp.org release-notes vendor-advisory
- 20160603 Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: June 2016 vendor-advisory
- VU#321640 third-party-advisory us-government-resource
- www.oracle.com third-party-advisory
- 20160604 [slackware-security] ntp (SSA:2016-155-01) mailing-list
- 20160604 FreeBSD Security Advisory FreeBSD-SA-16:24.ntp mailing-list
- 20160604 [slackware-security] ntp (SSA:2016-155-01) mailing-list
- 20160604 FreeBSD Security Advisory FreeBSD-SA-16:24.ntp mailing-list
- 91007 third-party-advisory vdb-entry
- 1036037 third-party-advisory vdb-entry
- USN-3096-1 vendor-advisory
- cert-portal.siemens.com third-party-advisory
- FEDORA-2016-50b0066b7f vendor-advisory
- FEDORA-2016-89e0874533 vendor-advisory
- FEDORA-2016-c3bd6a3496 vendor-advisory
- FreeBSD-SA-16:24 third-party-advisory vendor-advisory
- GLSA-201607-15 third-party-advisory vendor-advisory
- us-cert.cisa.gov
- VU#321640 third-party-advisory