CVE-2023-26555 | Medium | 6.4 | 2023-04-11 | praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver. |
CVE-2023-26554 | Medium | 5.6 | 2023-04-11 | mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process… |
CVE-2023-26553 | Medium | 5.6 | 2023-04-11 | mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq proce… |
CVE-2023-26552 | Medium | 5.6 | 2023-04-11 | mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, b… |
CVE-2023-26551 | Medium | 5.6 | 2023-04-11 | mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, bu… |
CVE-2020-15025 | Medium | 4.4 | 2020-06-24 | ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, becaus… |
CVE-2020-13817 | High | 7.4 | 2020-06-04 | ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting tra… |
CVE-2018-8956 | Medium | 5.3 | 2020-05-06 | ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP se… |
CVE-2020-11868 | High | 7.5 | 2020-04-17 | ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoof… |
CVE-2015-7851 | Medium | 6.5 | 2020-01-28 | Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' c… |
CVE-2014-5209 | Medium | 5.3 | 2020-01-08 | An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user… |
CVE-2019-8936 | High | 7.5 | 2019-05-15 | NTP through 4.2.8p12 has a NULL Pointer Dereference. |
CVE-2019-11331 | High | 8.1 | 2019-04-18 | Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote… |
CVE-2018-12327 | Critical | 9.8 | 2018-06-20 | Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long… |
CVE-2016-9042 | Medium | 5.9 | 2018-06-04 | An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network… |
CVE-2018-7183 | Critical | 9.8 | 2018-03-08 | Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query… |
CVE-2018-7185 | High | 7.5 | 2018-03-06 | The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zer… |
CVE-2018-7184 | High | 7.5 | 2018-03-06 | ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (dis… |
CVE-2018-7182 | High | 7.5 | 2018-03-06 | The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 pa… |
CVE-2018-7170 | Medium | 5.3 | 2018-03-06 | ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral as… |
CVE-2015-5146 | Medium | 5.3 | 2017-08-24 | ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a com… |
CVE-2015-3405 | High | 7.5 | 2017-08-09 | ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest… |
CVE-2015-7871 | Critical | 9.8 | 2017-08-07 | Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication. |
CVE-2015-7855 | Medium | 6.5 | 2017-08-07 | The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure)… |
CVE-2015-7854 | High | 8.8 | 2017-08-07 | Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a deni… |
CVE-2015-7853 | Critical | 9.8 | 2017-08-07 | The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a… |
CVE-2015-7852 | Medium | 5.9 | 2017-08-07 | ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets. |
CVE-2015-7850 | Medium | 6.5 | 2017-08-07 | ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing t… |
CVE-2015-7849 | High | 8.8 | 2017-08-07 | Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code… |
CVE-2015-7705 | Critical | 9.8 | 2017-08-07 | The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted re… |
CVE-2015-7704 | High | 7.5 | 2017-08-07 | The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages. |
CVE-2015-7702 | Medium | 6.5 | 2017-08-07 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This… |
CVE-2015-7701 | High | 7.5 | 2017-08-07 | Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (mem… |
CVE-2015-7692 | High | 7.5 | 2017-08-07 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This… |
CVE-2015-7691 | High | 7.5 | 2017-08-07 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted… |
CVE-2015-7703 | High | 7.5 | 2017-07-24 | The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allow… |
CVE-2015-5300 | High | 7.5 | 2017-07-21 | The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, whi… |
CVE-2015-5219 | High | 7.5 | 2017-07-21 | The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attac… |
CVE-2015-5195 | High | 7.5 | 2017-07-21 | ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen co… |
CVE-2015-5194 | High | 7.5 | 2017-07-21 | The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted lo… |
CVE-2017-6464 | Medium | 6.5 | 2017-03-27 | NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive. |
CVE-2017-6463 | Medium | 6.5 | 2017-03-27 | NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config d… |
CVE-2017-6462 | High | 7.8 | 2017-03-27 | Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have u… |
CVE-2017-6460 | High | 8.8 | 2017-03-27 | Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a… |
CVE-2017-6459 | Medium | 5.5 | 2017-03-27 | The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with mul… |
CVE-2017-6458 | High | 8.8 | 2017-03-27 | Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact… |
CVE-2017-6455 | High | 7.0 | 2017-03-27 | NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable. |
CVE-2017-6452 | High | 7.8 | 2017-03-27 | Stack-based buffer overflow in the Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via an appli… |
CVE-2017-6451 | High | 7.8 | 2017-03-27 | The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf… |
CVE-2016-2519 | Medium | 5.9 | 2017-01-30 | ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data value, which trigg… |
CVE-2016-2518 | Medium | 5.3 | 2017-01-30 | The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer reque… |
CVE-2016-2517 | Medium | 5.3 | 2017-01-30 | NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of… |
CVE-2016-2516 | Medium | 5.3 | 2017-01-30 | NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP addre… |
CVE-2015-8158 | Medium | 5.9 | 2017-01-30 | The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) vi… |
CVE-2015-8140 | Medium | 4.8 | 2017-01-30 | The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network. |
CVE-2015-8139 | Medium | 5.3 | 2017-01-30 | ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors. |
CVE-2015-8138 | Medium | 5.3 | 2017-01-30 | NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero. |
CVE-2015-7979 | High | 7.5 | 2017-01-30 | NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast pack… |
CVE-2015-7978 | High | 7.5 | 2017-01-30 | NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which trigger… |
CVE-2015-7977 | Medium | 5.9 | 2017-01-30 | ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command. |
CVE-2015-7976 | Medium | 4.3 | 2017-01-30 | The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attac… |
CVE-2015-7975 | Medium | 6.2 | 2017-01-30 | The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a deni… |
CVE-2015-7973 | Medium | 6.5 | 2017-01-30 | NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the net… |
CVE-2016-1551 | Low | 3.7 | 2017-01-27 | ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate… |
CVE-2016-9312 | High | 7.5 | 2017-01-13 | ntpd in NTP before 4.2.8p9, when running on Windows, allows remote attackers to cause a denial of service via a large UDP packet. |
CVE-2016-9311 | Medium | 5.9 | 2017-01-13 | ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a c… |
CVE-2016-9310 | Medium | 6.5 | 2017-01-13 | The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet. |
CVE-2016-7434 | High | 7.5 | 2017-01-13 | The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query. |
CVE-2016-7433 | Medium | 5.3 | 2017-01-13 | NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to… |
CVE-2016-7431 | Medium | 5.3 | 2017-01-13 | NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero. NOTE: this vulnerability exist… |
CVE-2016-7429 | Low | 3.7 | 2017-01-13 | NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of servi… |
CVE-2016-7428 | Medium | 4.3 | 2017-01-13 | ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast packet. |
CVE-2016-7427 | Medium | 4.3 | 2017-01-13 | The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode pa… |
CVE-2016-7426 | High | 7.5 | 2017-01-13 | NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers… |
CVE-2016-1550 | Medium | 5.3 | 2017-01-06 | An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. A… |
CVE-2016-1549 | Medium | 6.5 | 2017-01-06 | A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earl… |
CVE-2016-1548 | High | 7.2 | 2017-01-06 | An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After maki… |
CVE-2016-1547 | Medium | 5.3 | 2017-01-06 | An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f9… |
CVE-2015-7848 | High | 7.5 | 2017-01-06 | An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The… |
CVE-2016-4957 | High | 7.5 | 2016-07-05 | ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists becaus… |
CVE-2016-4956 | Medium | 5.3 | 2016-07-05 | ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packe… |
CVE-2016-4955 | Medium | 5.9 | 2016-07-05 | ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) b… |
CVE-2016-4954 | High | 7.5 | 2016-07-05 | The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification)… |
CVE-2016-4953 | High | 7.5 | 2016-07-05 | ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK pack… |
CVE-2015-7974 | High | 7.7 | 2016-01-26 | NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attacker… |
CVE-2014-9751 | | | 2015-10-06 | The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an… |
CVE-2014-9750 | | | 2015-10-06 | ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process me… |
CVE-2015-1799 | | | 2015-04-08 | The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certa… |
CVE-2015-1798 | | | 2015-04-08 | The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero l… |
CVE-2014-9296 | | | 2014-12-20 | The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote a… |
CVE-2014-9295 | | | 2014-12-20 | Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the cry… |
CVE-2014-9294 | | | 2014-12-20 | util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mec… |
CVE-2014-9293 | | | 2014-12-20 | The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attac… |
CVE-2013-5211 | | | 2014-01-02 | The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1)… |
CVE-2009-3563 | | | 2009-12-09 | ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIV… |
CVE-2009-1252 | | | 2009-05-19 | Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are e… |
CVE-2009-0159 | | | 2009-04-14 | Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code vi… |
CVE-2009-0021 | | | 2009-01-07 | NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote att… |
CVE-2004-0657 | | | 2004-08-06 | Integer overflow in the NTP daemon (NTPd) before 4.0 causes the NTP server to return the wrong date/time offset when a client requests a date/time that is more… |