Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-4956

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.

Published

2016-07-05T01:59:03.283

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	ntp	ntp	< 4.2.8	Yes
Application	ntp	ntp	< 4.3.93	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Application	ntp	ntp	4.2.8	Yes
Operating System	oracle	solaris	10	Yes
Operating System	oracle	solaris	11.3	Yes
Application	suse	manager_proxy	2.1	Yes
Application	suse	openstack_cloud	5	Yes
Operating System	novell	suse_manager	2.1	Yes
Operating System	opensuse	leap	42.1	Yes
Operating System	opensuse	opensuse	13.2	Yes
Operating System	suse	linux_enterprise_desktop	12	Yes
Operating System	suse	linux_enterprise_server	11	Yes
Operating System	suse	linux_enterprise_server	11	Yes
Operating System	suse	linux_enterprise_server	11	Yes
Operating System	suse	linux_enterprise_server	12	Yes
Operating System	siemens	simatic_net_cp_443-1_opc_ua_firmware	*	Yes
Hardware	siemens	simatic_net_cp_443-1_opc_ua	-	No

References

http://bugs.ntp.org/3042 Issue Tracking, Vendor Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html Mailing List, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html ([email protected])
http://packetstormsecurity.com/files/137321/Slackware-Security-Advisory-ntp-Updates.html ([email protected])
http://support.ntp.org/bin/view/Main/NtpBug3042 Vendor Advisory ([email protected])
http://support.ntp.org/bin/view/Main/SecurityNotice Release Notes, Vendor Advisory ([email protected])
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ntpd ([email protected])
http://www.kb.cert.org/vuls/id/321640 Third Party Advisory, US Government Resource ([email protected])
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory ([email protected])
http://www.securityfocus.com/archive/1/538599/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/538600/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/540683/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/archive/1/538599/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/archive/1/538600/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/archive/1/540683/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/91009 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id/1036037 Third Party Advisory, VDB Entry ([email protected])
http://www.ubuntu.com/usn/USN-3096-1 ([email protected])
https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf Third Party Advisory ([email protected])
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03757en_us Third Party Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3EYJQHJZ2KTVQ7ICEFHXTLZ36MRASWX/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORAMN3Q7TVJ54MBYF75XCJOE3DP7LYHT/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNWGCQLW2VY72NIUYMJOCAKJKTXHDUK2/ ([email protected])
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:24.ntp.asc Third Party Advisory ([email protected])
https://security.gentoo.org/glsa/201607-15 Third Party Advisory ([email protected])
https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11 ([email protected])
https://www.kb.cert.org/vuls/id/321640 ([email protected])
http://bugs.ntp.org/3042 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/137321/Slackware-Security-Advisory-ntp-Updates.html (af854a3a-2127-422b-91ae-364da2661108)
http://support.ntp.org/bin/view/Main/NtpBug3042 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://support.ntp.org/bin/view/Main/SecurityNotice Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ntpd (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/321640 Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/538599/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/538600/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/540683/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/archive/1/538599/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/archive/1/538600/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/archive/1/540683/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/91009 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1036037 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/USN-3096-1 (af854a3a-2127-422b-91ae-364da2661108)
https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03757en_us Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3EYJQHJZ2KTVQ7ICEFHXTLZ36MRASWX/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORAMN3Q7TVJ54MBYF75XCJOE3DP7LYHT/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNWGCQLW2VY72NIUYMJOCAKJKTXHDUK2/ (af854a3a-2127-422b-91ae-364da2661108)
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:24.ntp.asc Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/201607-15 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11 (af854a3a-2127-422b-91ae-364da2661108)
https://www.kb.cert.org/vuls/id/321640 (af854a3a-2127-422b-91ae-364da2661108)