Vulnerability in Ntp
CVE-2016-1549
A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock.
EPSS: 0.031 (86.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Ntp — versions 4.2.8
- Ntp Project — versions 4.2.8p3, 4.2.8p4
- Ntpsec Project — versions 3e160db8dc248a0bcb053b56a80167dc742d2b74, a5fb34b9cc89b92a8fef2f459004865c93bb7f92
Weakness classification (CWE)
References
- cret@cert.org (Technical Description, Third Party Advisory, x_refsource_MISC, Mitigation)
- cret@cert.org (vdb-entry, x_refsource_BID)
- cret@cert.org (vdb-entry, x_refsource_SECTRACK)
- cret@cert.org (x_refsource_CONFIRM)
- cret@cert.org (x_refsource_CONFIRM)
- cret@cert.org (x_refsource_FREEBSD, vendor-advisory)
- cret@cert.org (x_refsource_CONFIRM)
- cret@cert.org (vendor-advisory, x_refsource_GENTOO)
- cret@cert.org (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2016-1549?
- CVE-2016-1549 is a medium-severity vulnerability in Ntp, classified under CWE-19. CVSS score: 6.5/10. Published 2017-01-06.
- How severe is CVE-2016-1549?
- Medium severity. CVSS v3 base score is 6.5 out of 10.