PT-2016-4857 · Ntpsec+8 · Ntpsec+10

Loganaden Velvindron + 2 · Publicado 2016-04-28 · Atualizado 2025-04-20 · CVE-2016-1550

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ntp versions 4.2.8p4 NTPSec version a5fb34b9cc89b92a8fef2f459004865c93bb7f92

Description An issue exists in the message authentication functionality of libntp, allowing an attacker to send crafted messages in an attempt to recover the message digest key. This could potentially be exploited by sending a series of crafted messages.

Recommendations For ntp version 4.2.8p4, consider updating to a version where this issue is resolved, as the current version is affected. For NTPSec version a5fb34b9cc89b92a8fef2f459004865c93bb7f92, restrict access to the message authentication functionality until a patch is available. As a temporary workaround, consider disabling the message authentication functionality in libntp until a patch is available.

Correção

DoS

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CESA-2016_1141

CVE-2016-1550

DLA-559-1

DSA-3629-1

MGASA-2016-0174

OPENSUSE-SU-2016_1329-1

OPENSUSE-SU-2024:10181-1

RHSA-2016:1141

RHSA-2016:1552

RHSA-2016_1141

SUSE-SU-2016:1278-1

SUSE-SU-2016:1291-1

SUSE-SU-2016:1471-1

SUSE-SU-2016:1568-1

USN-3096-1

Produtos afetados

Centos

Cisco Ios Xr

Cisco Nexus

Fortios

Freebsd

Ntpsec

Red Hat

Suse

Ubuntu

Libntp

Ntp

Referências · 160

• https://security.freebsd.org/advisories/FreeBSD-SA-16:16.ntp.asc · Aviso do Fabricante
• https://security.gentoo.org/glsa/201607-15 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-7433 · Nota
• http://debian.org/security/2016/dsa-3629 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-7976 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-1552.html · Aviso do Fabricante
• http://packetstormsecurity.com/files/136864/Slackware-Security-Advisory-ntp-Updates.html · Nota
• https://bugzilla.suse.com/977455 · Nota
• https://suse.com/security/cve/CVE-2015-7692 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf · Nota
• https://cve.org/CVERecord?id=CVE-2016-1550 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-ntpd · Aviso do Fabricante
• https://talosintelligence.com/vulnerability_reports/TALOS-2016-0084 · Nota
• https://suse.com/security/cve/CVE-2016-2516 · Nota
• https://suse.com/security/cve/CVE-2016-7426 · Nota