PT-2016-6190 · Ntf+3 · Ntp+3

Nicolas Edet · Published 2016-06-13 · Updated 2024-06-15 · CVE-2016-4957

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NTP versions prior to 4.2.8p8

Description The issue allows remote attackers to cause a denial of service, resulting in the daemon crashing via a crypto-NAK packet. This problem exists due to an incorrect fix for a previous issue.

Recommendations For versions prior to 4.2.8p8, update to version 4.2.8p8 or later to resolve the issue.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2016-1711

CVE-2016-4957

OPENSUSE-SU-2016_1583-1

OPENSUSE-SU-2016_1636-1

OPENSUSE-SU-2024:10181-1

SUSE-SU-2016:1563-1

SUSE-SU-2016:1568-1

SUSE-SU-2016:1584-1

SUSE-SU-2016:1602-1

Affected Products

Alt Linux

Freebsd

Ntp

Suse

References · 106

• https://security.gentoo.org/glsa/201607-15 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html · Vendor Advisory
• http://support.ntp.org/bin/view/Main/NtpBug3046 · Vendor Advisory
• http://support.ntp.org/bin/view/Main/SecurityNotice · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1584-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1563-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html · Vendor Advisory
• https://security.freebsd.org/advisories/FreeBSD-SA-16:24.ntp.asc · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1602-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4957 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:1568-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4957 · Vendor Advisory