MEDIUM
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.
http://www.securityfocus.com/bid/97046
http://www.securitytracker.com/id/1038123
http://www.securitytracker.com/id/1039427
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:03.ntp.asc
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0260
Source: MITRE
Published: 2018-06-04
Updated: 2019-10-31
Type: CWE-20
Base Score: 4.3
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 8.6
Severity: MEDIUM
Base Score: 5.9
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 2.2
Severity: MEDIUM