CVE-2016-9042 — Improper Input Validation in Network Time Protocol
Severity
5.9MEDIUMNVD
EPSS
4.8%
top 10.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 4
Latest updateMay 13
Description
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6
Affected Packages4 packages
Also affects: Freebsd 10.0, 11.0
🔴Vulnerability Details
3GHSA▶
GHSA-7wvh-qg35-v45r: An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4↗2022-05-13
CVEList▶
CVE-2016-9042: An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4↗2018-06-04
OSV▶
CVE-2016-9042: An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4↗2018-06-04
📋Vendor Advisories
5Debian▶
CVE-2016-9042: ntp - An exploitable denial of service vulnerability exists in the origin timestamp ch...↗2016