PT-2016-6186 · Cisco+3 · Ntp+6
Jakub Prokes
+1
·
Publicado
2016-06-03
·
Atualizado
2024-06-15
·
CVE-2016-4953
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
NTP versions 4.x before 4.2.8p8
Description
The issue allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time. Multiple Cisco products that incorporate a version of the Network Time Protocol daemon (ntpd) package are affected, which could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or modify the time being advertised by a device acting as a Network Time Protocol (NTP) server.
Recommendations
For NTP versions 4.x before 4.2.8p8, update to version 4.2.8p8 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
ntpd package to minimize the risk of exploitation.
Avoid using the crypto-NAK packet in the affected NTP protocol until the issue is resolved.
Restrict access to the vulnerable ntpd package to minimize the risk of exploitation.Correção
DoS
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Cisco Ios
Cisco Ios Xr
Cisco Nexus
Freebsd
Ntp
Suse