CVE-2016-4955 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 89%

Vendor	Product	Version
ntp	ntp	4.2.0 ≤ 𝑥 < 4.2.8
ntp	ntp	4.3.0 ≤ 𝑥 < 4.3.93
ntp	ntp	4.2.8
ntp	ntp	4.2.8:p1
ntp	ntp	4.2.8:p1-beta1
ntp	ntp	4.2.8:p1-beta2
ntp	ntp	4.2.8:p1-beta3
ntp	ntp	4.2.8:p1-beta4
ntp	ntp	4.2.8:p1-beta5
ntp	ntp	4.2.8:p1-rc1
ntp	ntp	4.2.8:p1-rc2
ntp	ntp	4.2.8:p2
ntp	ntp	4.2.8:p2-rc1
ntp	ntp	4.2.8:p2-rc2
ntp	ntp	4.2.8:p2-rc3
ntp	ntp	4.2.8:p3
ntp	ntp	4.2.8:p3-rc1
ntp	ntp	4.2.8:p3-rc2
ntp	ntp	4.2.8:p3-rc3
ntp	ntp	4.2.8:p4
ntp	ntp	4.2.8:p5
ntp	ntp	4.2.8:p6
ntp	ntp	4.2.8:p7
oracle	solaris	11.3
suse	manager_proxy	2.1
novell	suse_manager	2.1
opensuse	leap	42.1
opensuse	opensuse	13.2
siemens	simatic_net_cp_443-1_opc_ua_firmware	*

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ntp

bullseye	1:4.2.8p15+dfsg-1 fixed
jessie	no-dsa
wheezy	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

ntp

zesty	not-affected
yakkety	not-affected
xenial	Fixed 1:4.2.8p4+dfsg-3ubuntu5.3 released
wily	ignored
trusty	Fixed 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 released
precise	Fixed 1:4.2.6.p3+dfsg-1ubuntu3.11 released

Common Weakness Enumeration

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References

http://bugs.ntp.org/3043

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html

http://packetstormsecurity.com/files/137321/Slackware-Security-Advisory-ntp-Updates.html

http://packetstormsecurity.com/files/137322/FreeBSD-Security-Advisory-FreeBSD-SA-16-24.ntp.html

http://support.ntp.org/bin/view/Main/NtpBug3043

http://support.ntp.org/bin/view/Main/SecurityNotice

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ntpd

http://www.kb.cert.org/vuls/id/321640

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.securityfocus.com/archive/1/538599/100/0/threaded

http://www.securityfocus.com/archive/1/538600/100/0/threaded

http://www.securityfocus.com/archive/1/archive/1/538599/100/0/threaded

http://www.securityfocus.com/archive/1/archive/1/538600/100/0/threaded

http://www.securityfocus.com/bid/91007

http://www.securitytracker.com/id/1036037

http://www.ubuntu.com/usn/USN-3096-1

https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3EYJQHJZ2KTVQ7ICEFHXTLZ36MRASWX/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORAMN3Q7TVJ54MBYF75XCJOE3DP7LYHT/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNWGCQLW2VY72NIUYMJOCAKJKTXHDUK2/

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:24.ntp.asc

https://security.gentoo.org/glsa/201607-15

https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11

https://www.kb.cert.org/vuls/id/321640

http://bugs.ntp.org/3043

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html

http://packetstormsecurity.com/files/137321/Slackware-Security-Advisory-ntp-Updates.html

http://packetstormsecurity.com/files/137322/FreeBSD-Security-Advisory-FreeBSD-SA-16-24.ntp.html

http://support.ntp.org/bin/view/Main/NtpBug3043

http://support.ntp.org/bin/view/Main/SecurityNotice

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ntpd

http://www.kb.cert.org/vuls/id/321640

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.securityfocus.com/archive/1/538599/100/0/threaded

http://www.securityfocus.com/archive/1/538600/100/0/threaded

http://www.securityfocus.com/archive/1/archive/1/538599/100/0/threaded

http://www.securityfocus.com/archive/1/archive/1/538600/100/0/threaded

http://www.securityfocus.com/bid/91007

http://www.securitytracker.com/id/1036037

http://www.ubuntu.com/usn/USN-3096-1

https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3EYJQHJZ2KTVQ7ICEFHXTLZ36MRASWX/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORAMN3Q7TVJ54MBYF75XCJOE3DP7LYHT/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNWGCQLW2VY72NIUYMJOCAKJKTXHDUK2/

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:24.ntp.asc

https://security.gentoo.org/glsa/201607-15

https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11

https://www.kb.cert.org/vuls/id/321640