cbcvebase.
CVE-2016-4954
published 2016-07-05

CVE-2016-4954: The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification)…

high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.

Affected

17 ranges
VendorProductVersion rangeFixed in
debianntp< ntp 1:4.2.8p8+dfsg-1 (bullseye)ntp 1:4.2.8p8+dfsg-1 (bullseye)
ntpntp
ntpntp>= 0 < 1:4.2.8p8+dfsg-11:4.2.8p8+dfsg-1
ntpntp>= 0 < 1:4.2.6.p5+dfsg-3ubuntu2.14.04.101:4.2.6.p5+dfsg-3ubuntu2.14.04.10
ntpntp>= 0 < 1:4.2.8p4+dfsg-3ubuntu5.31:4.2.8p4+dfsg-3ubuntu5.3
ntpntp>= 4.2.0 < 4.2.84.2.8
ntpntp>= 4.3.0 < 4.3.934.3.93
opensuseleap
opensuseopensuse
oraclesolaris
oraclesolaris
suselinux_enterprise_desktop
suselinux_enterprise_server
suselinux_enterprise_server
susemanager
susemanager_proxy
suseopenstack_cloud

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH