cbcvebase.
CVE-2016-1548
published 2017-01-06

CVE-2016-1548: An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After…

PriorityP342high7.2CVSS 3.0
AVNACLPRNUINSCCNILAL
EPSS
3.84%
89.0th percentile
An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.

Affected

19 ranges
VendorProductVersion rangeFixed in
debianntp< ntp 1:4.2.8p8+dfsg-1 (bullseye)ntp 1:4.2.8p8+dfsg-1 (bullseye)
debianntp< ntp 1:4.2.8p7+dfsg-1 (bullseye)ntp 1:4.2.8p7+dfsg-1 (bullseye)
novellsuse_manager
ntpntp
ntpntp>= 0 < 1:4.2.8p8+dfsg-11:4.2.8p8+dfsg-1
ntpntp>= 0 < 1:4.2.8p7+dfsg-11:4.2.8p7+dfsg-1
ntpntp>= 0 < 1:4.2.6.p5+dfsg-3ubuntu2.14.04.101:4.2.6.p5+dfsg-3ubuntu2.14.04.10
ntpntp>= 0 < 1:4.2.8p4+dfsg-3ubuntu5.31:4.2.8p4+dfsg-3ubuntu5.3
ntpntp>= 4.2.0 < 4.2.84.2.8
ntpntp>= 4.3.0 < 4.3.934.3.93
opensuseleap
opensuseopensuse
oraclesolaris
oraclesolaris
suselinux_enterprise_desktop
suselinux_enterprise_server
suselinux_enterprise_server
susemanager_proxy
suseopenstack_cloud

CVSS provenance

nvdv3.07.2HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P
osv7.2HIGH
vendor_debian7.2HIGH
vendor_redhat7.2HIGH
vendor_ubuntu6.5MEDIUM
vendor_cisco5.3MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.