CVE-2016-1549

A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 86%
Affected Products (NVD)
VendorProductVersion
ntpntp
4.2.8:p4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ntp
bullseye
1:4.2.8p15+dfsg-1
fixed
jessie
no-dsa
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ntp
precise
ignored
trusty
ignored
wily
ignored
xenial
ignored
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ntp
Amazon Linux 1
0:4.2.8p11-1.37.amzn1
fixed
ntp-debuginfo
Amazon Linux 1
0:4.2.8p11-1.37.amzn1
fixed
ntp-doc
Amazon Linux 1
0:4.2.8p11-1.37.amzn1
fixed
ntp-perl
Amazon Linux 1
0:4.2.8p11-1.37.amzn1
fixed
ntpdate
Amazon Linux 1
0:4.2.8p11-1.37.amzn1
fixed
Common Weakness Enumeration
References
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securityfocus.com/bid/88200
http://www.securitytracker.com/id/1035705
http://www.talosintelligence.com/reports/TALOS-2016-0083/
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc
https://security.gentoo.org/glsa/201607-15
https://security.netapp.com/advisory/ntap-20171004-0002/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
https://www.synology.com/support/security/Synology_SA_18_13
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securityfocus.com/bid/88200
http://www.securitytracker.com/id/1035705
http://www.talosintelligence.com/reports/TALOS-2016-0083/
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc
https://security.gentoo.org/glsa/201607-15
https://security.netapp.com/advisory/ntap-20171004-0002/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
https://www.synology.com/support/security/Synology_SA_18_13