PT-2016-7325 · Cisco+6 · Cisco+7
Miroslav Lichvar
·
Publicado
2016-11-23
·
Atualizado
2024-06-15
·
CVE-2016-7429
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
NTP versions prior to 4.2.8p9
Cisco products (affected versions not specified)
Description
The issue allows remote attackers to cause a denial of service by sending a response for a source to an interface the source does not use. Multiple vulnerabilities in the Network Time Protocol daemon package could allow an unauthenticated, remote attacker to cause a denial of service condition or modify the time being advertised by a device acting as a Network Time Protocol server. These vulnerabilities include issues related to denial of service and logic problems that may allow an attacker to shift a system's time.
Recommendations
For NTP versions prior to 4.2.8p9, update to version 4.2.8p9 or later to resolve the issue.
For Cisco products, refer to the Cisco bug for each affected product to find available workarounds that address one or more of these vulnerabilities.
As a temporary workaround, consider restricting access to the NTP service to minimize the risk of exploitation.
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Cisco
Cisco Nexus
Ntp
Red Hat
Suse
Ubuntu