CVE-2016-7426 — Uncontrolled Resource Consumption in HPE Hpux-ntp

CWE-400 — Uncontrolled Resource ConsumptionCWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-20 — Improper Input ValidationCWE-39913 documents10 sources
Severity
7.5HIGHNVD
EPSS
11.7%
top 6.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
NTPHPE Hpux-ntpCanonical Ubuntu Linux+6 more
Timeline
PublishedJan 13
Latest updateMay 13

Description

NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶NVDntp/ntp4.2.6 — 4.2.8+3
▶NVDhpe/hpux-ntpb.11.31 — c.4.2.8.2.0
▶Debianntp/ntp< 1:4.2.8p9+dfsg-1

Also affects: Ubuntu Linux 12.04, Enterprise Linux 7.3, 7.4, 7.6, 7.7, 7.5

🔴Vulnerability Details

4
GHSA
GHSA-8wjh-3x3g-6pjf: NTP before 4↗2022-05-13
▶
OSV
ntp vulnerabilities↗2017-07-05
▶
OSV
CVE-2016-7426: NTP before 4↗2017-01-13
▶
CVEList
CVE-2016-7426: NTP before 4↗2017-01-13
▶

📋Vendor Advisories

6
Ubuntu
NTP vulnerabilities↗2019-01-23
▶
Ubuntu
NTP vulnerabilities↗2017-07-05
▶
BSD
FreeBSD-SA-16:39.ntp: Multiple vulnerabilities of ntp↗2016-12-22
▶
Cisco
Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: November 2016↗2016-11-23
▶
Red Hat
ntp: Client rate limiting and server responses↗2016-11-21
▶

💬Community

2
Bugzilla
CVE-2016-7426 CVE-2016-7429 CVE-2016-7433 CVE-2016-9310 CVE-2016-9311 ntp: various flaws [fedora-all]↗2016-11-22
▶
Bugzilla
CVE-2016-7426 ntp: Client rate limiting and server responses↗2016-11-22
▶
CVE-2016-7426 — Uncontrolled Resource Consumption | cvebase