CVE-2016-4957 ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.
HighCVSS 7.5
EPSS 44.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ntp(Debian:11) | < 1:4.2.8p8+dfsg-1 | 1:4.2.8p8+dfsg-1 |
| ntp | = 4.2.8-p7 | No fix listed |
| ntp | = 4.3.92 | No fix listed |
| oracle solaris | = 10 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
| SUSE manager proxy | = 2.1 | No fix listed |
| SUSE openstack cloud | = 5 | No fix listed |
| novell suse manager | = 2.1 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| SUSE linux enterprise desktop | = 12-sp1 | No fix listed |
| SUSE linux enterprise server | = 11-sp2 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp4 | No fix listed |
| SUSE linux enterprise server | = 12-sp1 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- bugs.ntp.org issue-tracking vendor-advisory
- SUSE-SU-2016:1563 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:1583 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1584 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1602 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:1636 mailing-list third-party-advisory vendor-advisory
- support.ntp.org patch vendor-advisory
- support.ntp.org release-notes vendor-advisory
- VU#321640 third-party-advisory us-government-resource
- www.oracle.com third-party-advisory
- 1036037 third-party-advisory vdb-entry
- FreeBSD-SA-16:24 third-party-advisory vendor-advisory
- GLSA-201607-15 third-party-advisory vendor-advisory