CVE-2016-9042
Published: 31 December 2016
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.
Notes
Author | Note |
---|---|
mdeslaur | ntp-4.2.8p9 (21 Nov 2016), up to but not including ntp-4.2.8p10 introduced in patch for CVE-2016-7431 |
Priority
Status
Package | Release | Status |
---|---|---|
ntp Launchpad, Ubuntu, Debian |
precise |
Not vulnerable
(1:4.2.6.p3+dfsg-1ubuntu3.11)
|
trusty |
Not vulnerable
(1:4.2.6.p5+dfsg-3ubuntu2.14.04.10)
|
|
upstream |
Released
(1:4.2.8p10+dfsg-1)
|
|
xenial |
Not vulnerable
(1:4.2.8p4+dfsg-3ubuntu5.3)
|
|
yakkety |
Released
(1:4.2.8p8+dfsg-1ubuntu2.1)
|
|
zesty |
Released
(1:4.2.8p9+dfsg-2ubuntu1.1)
|
|
Patches: upstream: http://bk1.ntp.org/ntp-stable/?PAGE=cset&REV=58b56309OyBGP4pGEYHVzLh4VoQ8pg |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 5.9 |
Attack vector | Network |
Attack complexity | High |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |