CVE-2016-4957

Опубликовано: 05 июл. 2016

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Средний

Описание

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.

Ссылки

http://bugs.ntp.org/3046
Issue Tracking
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html
Mailing List
Third Party Advisory
http://support.ntp.org/bin/view/Main/NtpBug3046
Patch
Vendor Advisory
http://support.ntp.org/bin/view/Main/SecurityNotice
Release Notes
Vendor Advisory
http://www.kb.cert.org/vuls/id/321640
Third Party Advisory
US Government Resource
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Third Party Advisory
http://www.securitytracker.com/id/1036037
Third Party Advisory
VDB Entry
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:24.ntp.asc
Third Party Advisory
https://security.gentoo.org/glsa/201607-15
Third Party Advisory
http://bugs.ntp.org/3046
Issue Tracking
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html
Mailing List
Third Party Advisory
http://support.ntp.org/bin/view/Main/NtpBug3046
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ntp:ntp:4.2.8:p7:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.92:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*

cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:suse:manager_proxy:2.1:*:*:*:*:*:*:*

cpe:2.3:a:suse:openstack_cloud:5:*:*:*:*:*:*:*

cpe:2.3:o:novell:suse_manager:2.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.53716

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-476

Связанные уязвимости

CVE-2016-4957

CVSS3: 7.5

ubuntu

больше 9 лет назад

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.

CVE-2016-4957

redhat

больше 9 лет назад

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.

CVE-2016-4957

CVSS3: 7.5

debian

больше 9 лет назад

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial o ...

GHSA-3mq4-x52h-fcwc

CVSS3: 7.5

github

больше 3 лет назад

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.

openSUSE-SU-2016:1636-1

suse-cvrf

больше 9 лет назад

Security update for ntp

EPSS

Процентиль: 98%

0.53716

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-476