CVSS: 7.5EPSS: 2%CPEs: 41EXPL: 0CVE-2016-4954
https://notcve.org/view.php?id=CVE-2016-4954
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication. La función process_packet en ntp_proto.c en ntpd en NTP 4.x en versiones anteriores a 4.2.8p8 permite a atacantes remotos provocar una denegación de servicio (modificación de par variable) enviando paquetes falsificados desde muchas direcciones IP de origen en un determinado escenario, según lo demostrado desencadenando una indicación de salto incorrecta. • http://bugs.ntp.org/3044 http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html http://lists.opensuse.org/ • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.9EPSS: 2%CPEs: 37EXPL: 0CVE-2016-4955
https://notcve.org/view.php?id=CVE-2016-4955
ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time. ntpd en NTP 4.x en versiones anteriores a 4.2.8p8, cuando está habilitada la autoclave, permite a atacantes remotos provocar una denegación de servicio (limpiando el par variable y corte de asociación) enviando (1) un paquete crypto-NAK manipulado o (2) un paquete con un valor MAC incorrecto en un momento determinado. • http://bugs.ntp.org/3043 http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html http://lists.opensuse.org/ • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.3EPSS: 2%CPEs: 37EXPL: 0CVE-2016-4956
https://notcve.org/view.php?id=CVE-2016-4956
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548. ntpd en NTP 4.x en versiones anteriores a 4.2.8p8 permite a atacantes remotos provocar una denegación de servicio (transición de modo intercalado y cambio de hora) a través de un paquete de difusión manipulado. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2016-1548. • http://bugs.ntp.org/3042 http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html http://lists.opensuse.org/ •
CVSS: 7.1EPSS: 1%CPEs: 93EXPL: 0CVE-2016-2516
https://notcve.org/view.php?id=CVE-2016-2516
NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times in an unconfig directive. NTP en versiones anteriores a 4.2.8p7 y 4.3.x en versiones anteriores a 4.3.92, cuando mode7 está habilitado, permite a atacantes remotos provocar una denegación de servicio (anular ntpd) usando la misma dirección IP varias veces en una directiva unconfig. • http://support.ntp.org/bin/view/Main/NtpBug3011 http://www.debian.org/security/2016/dsa-3629 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/88180 http://www.securitytracker.com/id/1035705 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc https://security.gentoo.org/glsa/201607-15 https://security.netapp.com/advisory/ntap-20171004-0002 https://www.kb.cert.org/vuls/id/718152 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 93EXPL: 0CVE-2016-2517
https://notcve.org/view.php?id=CVE-2016-2517
NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression. NTP en versiones anteriores a 4.2.8p7 y 4.3.x en versiones anteriores a 4.3.92 permite a los atacantes remotos provocar una denegación de servicio (evitar la posterior autenticación) aprovechando el conocimiento de la clave de control o requestkey y enviando un paquete creado a ntpd, que cambia el valor de trustedkey, Controlkey o requestkey. NOTA: esta vulnerabilidad existe debido a una regresión de la CVE-2016-2516. • http://support.ntp.org/bin/view/Main/NtpBug3010 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/88189 http://www.securitytracker.com/id/1035705 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc https://security.gentoo.org/glsa/201607-15 https://security.netapp.com/advisory/ntap-20171004-0002 https://www.kb.cert.org/vuls/id/718152 • CWE-20: Improper Input Validation •