CVE-2016-7433 — Incorrect Calculation in NTP

CWE-682 — Incorrect CalculationCWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-20 — Improper Input ValidationCWE-39913 documents10 sources
Severity
5.3MEDIUMNVD
OSV5.9
EPSS
6.8%
top 8.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
NTPDebian NTP
Timeline
PublishedJan 13
Latest updateMay 13

Description

NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance that did not include the peer dispersion."

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶debiandebian/ntp< ntp 1:4.2.8p9+dfsg-1 (bullseye)
▶Debianntp/ntp< 1:4.2.8p9+dfsg-1
▶Ubuntuntp/ntp< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.11+1
▶NVDntp/ntp4.2.8

🔴Vulnerability Details

3
GHSA
GHSA-5x79-wfvw-985r: NTP before 4↗2022-05-13
▶
OSV
ntp vulnerabilities↗2017-07-05
▶
OSV
CVE-2016-7433: NTP before 4↗2017-01-13
▶

📋Vendor Advisories

7
CISA ICS
Siemens SIMATIC NET CP 443-1 OPC UA↗2021-06-08
▶
Ubuntu
NTP vulnerabilities↗2017-07-05
▶
BSD
FreeBSD-SA-16:39.ntp: Multiple vulnerabilities of ntp↗2016-12-22
▶
Cisco
Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: November 2016↗2016-11-23
▶
Red Hat
ntp: Broken initial sync calculations regression↗2016-11-21
▶

💬Community

2
Bugzilla
CVE-2016-7433 ntp: Broken initial sync calculations regression↗2016-11-22
▶
Bugzilla
CVE-2016-7426 CVE-2016-7429 CVE-2016-7433 CVE-2016-9310 CVE-2016-9311 ntp: various flaws [fedora-all]↗2016-11-22
▶