CVE-2016-9042

MEDIUM

Description

An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.

References

http://www.securityfocus.com/bid/97046

http://www.securitytracker.com/id/1038123

http://www.securitytracker.com/id/1039427

https://security.FreeBSD.org/advisories/FreeBSD-SA-17:03.ntp.asc

https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0260

Details

Source: MITRE

Published: 2018-06-04

Updated: 2018-08-02

Type: CWE-20

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3.0

Base Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 2.2

Severity: MEDIUM