CVE-2016-1549

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock.

References

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.securityfocus.com/bid/88200

http://www.securitytracker.com/id/1035705

http://www.talosintelligence.com/reports/TALOS-2016-0083/

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc

https://security.gentoo.org/glsa/201607-15

https://security.netapp.com/advisory/ntap-20171004-0002/

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us

https://www.synology.com/support/security/Synology_SA_18_13

Details

Source: MITRE

Published: 2017-01-06

Updated: 2018-03-28

Type: CWE-19

Risk Information

CVSS v2

Base Score: 4

Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8

Severity: MEDIUM

CVSS v3

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Impact Score: 3.6

Exploitability Score: 2.8

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:ntp:ntp:4.2.8:p4:*:*:*:*:*:*

Tenable Plugins

View all (24 total)

IDNameProductFamilySeverity
118269SUSE SLES12 Security Update : ntp (SUSE-SU-2018:1765-2)NessusSuSE Local Security Checks
critical
111995Slackware 14.0 / 14.1 / 14.2 / current : ntp (SSA:2018-229-01)NessusSlackware Local Security Checks
critical
111968Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p12 / 4.3.x < 4.3.94 Multiple VulnerabilitiesNessusMisc.
critical
110639SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2018:1765-1)NessusSuSE Local Security Checks
critical
110224SUSE SLES12 Security Update : ntp (SUSE-SU-2018:1464-1)NessusSuSE Local Security Checks
critical
109697Amazon Linux AMI : ntp (ALAS-2018-1009)NessusAmazon Linux Local Security Checks
critical
109102openSUSE Security Update : ntp (openSUSE-2018-376)NessusSuSE Local Security Checks
critical
109085SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2018:0956-1)NessusSuSE Local Security Checks
critical
108651SUSE SLES11 Security Update : ntp (SUSE-SU-2018:0808-1)NessusSuSE Local Security Checks
critical
107258Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p11 Multiple VulnerabilitiesNessusMisc.
critical
107103Slackware 14.0 / 14.1 / 14.2 / current : ntp (SSA:2018-060-02)NessusSlackware Local Security Checks
high
107061Arista Networks EOS Multiple Vulnerabilities (SA0019)NessusMisc.
high
107046FreeBSD : ntp -- multiple vulnerabilities (af485ef4-1c58-11e8-8477-d05099c0ae8c)NessusFreeBSD Local Security Checks
critical
104100Juniper Junos Space < 17.1R1 Multiple Vulnerabilities (JSA10826)NessusJunos Local Security Checks
high
93186SUSE SLES10 Security Update : ntp (SUSE-SU-2016:1912-1)NessusSuSE Local Security Checks
critical
92485GLSA-201607-15 : NTP: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
91663SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2016:1568-1)NessusSuSE Local Security Checks
critical
91403openSUSE Security Update : ntp (openSUSE-2016-649)NessusSuSE Local Security Checks
critical
91269openSUSE Security Update : ntp (openSUSE-2016-599)NessusSuSE Local Security Checks
critical
91159SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2016:1291-1)NessusSuSE Local Security Checks
critical
91120SUSE SLES11 Security Update : ntp (SUSE-SU-2016:1278-1)NessusSuSE Local Security Checks
critical
90923Network Time Protocol Daemon (ntpd) 3.x / 4.x < 4.2.8p7 Multiple VulnerabilitiesNessusMisc.
critical
90800Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : ntp (SSA:2016-120-01)NessusSlackware Local Security Checks
high
90742FreeBSD : ntp -- multiple vulnerabilities (b2487d9a-0c30-11e6-acd0-d050996490d0)NessusFreeBSD Local Security Checks
high