PT-2016-6188 · Cisco+4 · Ntp+6
Miroslav Lichvar
·
Publicado
2016-06-03
·
Atualizado
2024-06-15
·
CVE-2016-4955
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
NTP versions 4.x before 4.2.8p8
Description
The issue allows remote attackers to cause a denial of service by sending a spoofed crypto-NAK packet or a packet with an incorrect MAC value at a certain time when autokey is enabled. This can lead to peer-variable clearing and association outage. Multiple Cisco products that incorporate a version of the Network Time Protocol daemon package are affected, potentially allowing an unauthenticated, remote attacker to cause a denial of service condition or modify the time being advertised by a device acting as a Network Time Protocol server.
Recommendations
For NTP versions 4.x before 4.2.8p8, update to version 4.2.8p8 or later to resolve the issue. As a temporary workaround, consider disabling the autokey feature until a patch is available. Restrict access to the NTP server to minimize the risk of exploitation. Avoid using the autokey feature in the affected NTP version until the issue is resolved.
Correção
DoS
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Cisco Ios Xr
Cisco Nexus
Freebsd
Ntp
Suse
Ubuntu