PT-2016-3321 · Ntp+5 · Ntpsec+7

Matthew Van Gundy · Published 2016-04-28 · Updated 2025-04-20 · CVE-2016-1549

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions ntpd versions prior to 4.2.8p4 NTPsec versions prior to a5fb34b9cc89b92a8fef2f459004865c93bb7f92

Description A malicious authenticated peer can exploit an issue in the clock selection algorithm to modify a victim's clock. The issue is related to the handling of ephemeral associations, allowing an attacker to create multiple associations and influence the clock selection. This can potentially impact the integrity of data.

Recommendations For ntpd versions prior to 4.2.8p4, update to a version later than 4.2.8p4 to resolve the issue. For NTPsec versions prior to a5fb34b9cc89b92a8fef2f459004865c93bb7f92, update to a version later than a5fb34b9cc89b92a8fef2f459004865c93bb7f92 to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-19

Related Identifiers

ALT-PU-2018-1361

BDU:2021-00093

CVE-2016-1549

MGASA-2018-0195

OPENSUSE-SU-2016_1329-1

OPENSUSE-SU-2024:10181-1

SUSE-SU-2016:1278-1

SUSE-SU-2016:1291-1

SUSE-SU-2016:1471-1

SUSE-SU-2016:1568-1

SUSE-SU-2018:0808-1

SUSE-SU-2018:0956-1

SUSE-SU-2018:1464-1

SUSE-SU-2018:1765-1

SUSE-SU-2018:1765-2

Affected Products

Alt Linux

Cisco Ios Xr

Cisco Nexus

Freebsd

Ibm Aix

Ntpsec

Suse

Ntpd

References · 140

• https://security.freebsd.org/advisories/FreeBSD-SA-16:16.ntp.asc · Vendor Advisory
• https://security.gentoo.org/glsa/201607-15 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1549 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0956-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1765-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1549 · Security Note
• https://bdu.fstec.ru/vul/2021-00093 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:1765-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0808-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1464-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1278-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0195.html · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0195 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-1549 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-1549 · Vendor Advisory