Vulnerabilities > CVE-2016-9311 - NULL Pointer Dereference vulnerability in NTP 4.2.4/4.2.7/4.2.8

047910
CVSS 5.9 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
high complexity
ntp
CWE-476
nessus

Summary

ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.

Vulnerable Configurations

Part Description Count
Application
Ntp
3

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyOracleVM Local Security Checks
    NASL idORACLEVM_OVMSA-2017-0165.NASL
    descriptionThe remote OracleVM system is missing necessary patches to address critical security updates : - add disable monitor to default ntp.conf [CVE-2013-5211] - fix buffer overflow in datum refclock driver (CVE-2017-6462) - fix crash with invalid unpeer command (CVE-2017-6463) - fix potential crash with invalid server command (CVE-2017-6464) - don
    last seen2020-06-01
    modified2020-06-02
    plugin id104204
    published2017-10-27
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104204
    titleOracleVM 3.3 / 3.4 : ntp (OVMSA-2017-0165)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The package checks in this plugin were extracted from OracleVM
    # Security Advisory OVMSA-2017-0165.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(104204);
      script_version("3.4");
      script_cvs_date("Date: 2019/09/27 13:00:35");
    
      script_cve_id("CVE-2013-5211", "CVE-2015-7979", "CVE-2016-1547", "CVE-2016-1548", "CVE-2016-1550", "CVE-2016-2518", "CVE-2016-7426", "CVE-2016-7429", "CVE-2016-7433", "CVE-2016-9310", "CVE-2016-9311", "CVE-2017-6462", "CVE-2017-6463", "CVE-2017-6464");
      script_bugtraq_id(64692);
    
      script_name(english:"OracleVM 3.3 / 3.4 : ntp (OVMSA-2017-0165)");
      script_summary(english:"Checks the RPM output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote OracleVM host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote OracleVM system is missing necessary patches to address
    critical security updates :
    
      - add disable monitor to default ntp.conf [CVE-2013-5211]
    
      - fix buffer overflow in datum refclock driver
        (CVE-2017-6462)
    
      - fix crash with invalid unpeer command (CVE-2017-6463)
    
      - fix potential crash with invalid server command
        (CVE-2017-6464)
    
      - don't limit rate of packets from sources (CVE-2016-7426)
    
      - don't change interface from received packets
        (CVE-2016-7429)
    
      - fix calculation of root distance again (CVE-2016-7433)
    
      - require authentication for trap commands (CVE-2016-9310)
    
      - fix crash when reporting peer event to trappers
        (CVE-2016-9311)
    
      - don't allow spoofed packets to demobilize associations
        (CVE-2015-7979, CVE-2016-1547)
    
      - don't allow spoofed packet to enable symmetric
        interleaved mode (CVE-2016-1548)
    
      - check mode of new source in config command
        (CVE-2016-2518)
    
      - make MAC check resilient against timing attack
        (CVE-2016-1550)"
      );
      # https://oss.oracle.com/pipermail/oraclevm-errata/2017-October/000795.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?7c1983e3"
      );
      # https://oss.oracle.com/pipermail/oraclevm-errata/2017-October/000796.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?9454d3fb"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected ntp / ntpdate packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:vm:ntp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:vm:ntpdate");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:vm_server:3.3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:vm_server:3.4");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2014/01/02");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/10/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/10/27");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"OracleVM Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleVM/release", "Host/OracleVM/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/OracleVM/release");
    if (isnull(release) || "OVS" >!< release) audit(AUDIT_OS_NOT, "OracleVM");
    if (! preg(pattern:"^OVS" + "(3\.3|3\.4)" + "(\.[0-9]|$)", string:release)) audit(AUDIT_OS_NOT, "OracleVM 3.3 / 3.4", "OracleVM " + release);
    if (!get_kb_item("Host/OracleVM/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "OracleVM", cpu);
    if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);
    
    flag = 0;
    if (rpm_check(release:"OVS3.3", reference:"ntp-4.2.6p5-12.0.1.el6_9.1")) flag++;
    if (rpm_check(release:"OVS3.3", reference:"ntpdate-4.2.6p5-12.0.1.el6_9.1")) flag++;
    
    if (rpm_check(release:"OVS3.4", reference:"ntp-4.2.6p5-12.0.1.el6_9.1")) flag++;
    if (rpm_check(release:"OVS3.4", reference:"ntpdate-4.2.6p5-12.0.1.el6_9.1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ntp / ntpdate");
    }
    
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2016-326-01.NASL
    descriptionNew ntp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id95028
    published2016-11-22
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95028
    titleSlackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : ntp (SSA:2016-326-01)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Slackware Security Advisory 2016-326-01. The text 
    # itself is copyright (C) Slackware Linux, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(95028);
      script_version("2.3");
      script_cvs_date("Date: 2019/04/11 17:23:07");
    
      script_cve_id("CVE-2016-7426", "CVE-2016-7427", "CVE-2016-7428", "CVE-2016-7429", "CVE-2016-7431", "CVE-2016-7433", "CVE-2016-7434", "CVE-2016-9310", "CVE-2016-9311", "CVE-2016-9312");
      script_xref(name:"SSA", value:"2016-326-01");
    
      script_name(english:"Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : ntp (SSA:2016-326-01)");
      script_summary(english:"Checks for updated package in /var/log/packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Slackware host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "New ntp packages are available for Slackware 13.0, 13.1, 13.37, 14.0,
    14.1, 14.2, and -current to fix security issues."
      );
      # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.641761
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?271e3ad7"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected ntp package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:slackware:slackware_linux:ntp");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:13.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:13.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:13.37");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:14.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:14.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:14.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/11/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/22");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Slackware Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Slackware/release", "Host/Slackware/packages");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("slackware.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Slackware/release")) audit(AUDIT_OS_NOT, "Slackware");
    if (!get_kb_item("Host/Slackware/packages")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Slackware", cpu);
    
    
    flag = 0;
    if (slackware_check(osver:"13.0", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i486", pkgnum:"1_slack13.0")) flag++;
    if (slackware_check(osver:"13.0", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack13.0")) flag++;
    
    if (slackware_check(osver:"13.1", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i486", pkgnum:"1_slack13.1")) flag++;
    if (slackware_check(osver:"13.1", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack13.1")) flag++;
    
    if (slackware_check(osver:"13.37", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i486", pkgnum:"1_slack13.37")) flag++;
    if (slackware_check(osver:"13.37", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack13.37")) flag++;
    
    if (slackware_check(osver:"14.0", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i486", pkgnum:"1_slack14.0")) flag++;
    if (slackware_check(osver:"14.0", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack14.0")) flag++;
    
    if (slackware_check(osver:"14.1", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i486", pkgnum:"1_slack14.1")) flag++;
    if (slackware_check(osver:"14.1", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack14.1")) flag++;
    
    if (slackware_check(osver:"14.2", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i586", pkgnum:"1_slack14.2")) flag++;
    if (slackware_check(osver:"14.2", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack14.2")) flag++;
    
    if (slackware_check(osver:"current", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i586", pkgnum:"1")) flag++;
    if (slackware_check(osver:"current", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:slackware_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyF5 Networks Local Security Checks
    NASL idF5_BIGIP_SOL55405388.NASL
    descriptionntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet. (CVE-2016-9311)
    last seen2020-06-01
    modified2020-06-02
    plugin id100138
    published2017-05-12
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100138
    titleF5 Networks BIG-IP : NTP vulnerability (K55405388)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from F5 Networks BIG-IP Solution K55405388.
    #
    # The text description of this plugin is (C) F5 Networks.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100138);
      script_version("3.4");
      script_cvs_date("Date: 2019/07/17 16:36:41");
    
      script_cve_id("CVE-2016-9311");
    
      script_name(english:"F5 Networks BIG-IP : NTP vulnerability (K55405388)");
      script_summary(english:"Checks the BIG-IP version.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote device is missing a vendor-supplied security patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows
    remote attackers to cause a denial of service (NULL pointer
    dereference and crash) via a crafted packet. (CVE-2016-9311)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://support.f5.com/csp/article/K55405388"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade to one of the non-vulnerable versions listed in the F5
    Solution K55405388."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_access_policy_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_advanced_firewall_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_acceleration_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_security_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_visibility_and_reporting");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_global_traffic_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_link_controller");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_local_traffic_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_policy_enforcement_manager");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_webaccelerator");
      script_set_attribute(attribute:"cpe", value:"cpe:/h:f5:big-ip");
      script_set_attribute(attribute:"cpe", value:"cpe:/h:f5:big-ip_protocol_security_manager");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/12/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/05/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"F5 Networks Local Security Checks");
    
      script_dependencies("f5_bigip_detect.nbin");
      script_require_keys("Host/local_checks_enabled", "Host/BIG-IP/hotfix", "Host/BIG-IP/modules", "Host/BIG-IP/version", "Settings/ParanoidReport");
    
      exit(0);
    }
    
    
    include("f5_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    version = get_kb_item("Host/BIG-IP/version");
    if ( ! version ) audit(AUDIT_OS_NOT, "F5 Networks BIG-IP");
    if ( isnull(get_kb_item("Host/BIG-IP/hotfix")) ) audit(AUDIT_KB_MISSING, "Host/BIG-IP/hotfix");
    if ( ! get_kb_item("Host/BIG-IP/modules") ) audit(AUDIT_KB_MISSING, "Host/BIG-IP/modules");
    
    sol = "K55405388";
    vmatrix = make_array();
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    # AFM
    vmatrix["AFM"] = make_array();
    vmatrix["AFM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.4.0-11.6.1");
    vmatrix["AFM"]["unaffected"] = make_list("13.0.0HF1","12.1.2HF1");
    
    # AM
    vmatrix["AM"] = make_array();
    vmatrix["AM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.4.0-11.6.1");
    vmatrix["AM"]["unaffected"] = make_list("13.0.0HF1","12.1.2HF1");
    
    # APM
    vmatrix["APM"] = make_array();
    vmatrix["APM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.4.0-11.6.1","11.2.1","10.2.1-10.2.4");
    vmatrix["APM"]["unaffected"] = make_list("13.0.0HF1","12.1.2HF1");
    
    # ASM
    vmatrix["ASM"] = make_array();
    vmatrix["ASM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.4.0-11.6.1","11.2.1","10.2.1-10.2.4");
    vmatrix["ASM"]["unaffected"] = make_list("13.0.0HF1","12.1.2HF1");
    
    # AVR
    vmatrix["AVR"] = make_array();
    vmatrix["AVR"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.4.0-11.6.1","11.2.1");
    vmatrix["AVR"]["unaffected"] = make_list("13.0.0HF1","12.1.2HF1");
    
    # LC
    vmatrix["LC"] = make_array();
    vmatrix["LC"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.4.0-11.6.1","11.2.1","10.2.1-10.2.4");
    vmatrix["LC"]["unaffected"] = make_list("13.0.0HF1","12.1.2HF1");
    
    # LTM
    vmatrix["LTM"] = make_array();
    vmatrix["LTM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.4.0-11.6.1","11.2.1","10.2.1-10.2.4");
    vmatrix["LTM"]["unaffected"] = make_list("13.0.0HF1","12.1.2HF1");
    
    # PEM
    vmatrix["PEM"] = make_array();
    vmatrix["PEM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.4.0-11.6.1");
    vmatrix["PEM"]["unaffected"] = make_list("13.0.0HF1","12.1.2HF1");
    
    
    if (bigip_is_affected(vmatrix:vmatrix, sol:sol))
    {
      if (report_verbosity > 0) security_hole(port:0, extra:bigip_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = bigip_get_tested_modules();
      audit_extra = "For BIG-IP module(s) " + tested + ",";
      if (tested) audit(AUDIT_INST_VER_NOT_VULN, audit_extra, version);
      else audit(AUDIT_HOST_NOT, "running any of the affected modules");
    }
    
  • NASL familyOracleVM Local Security Checks
    NASL idORACLEVM_OVMSA-2017-0038.NASL
    descriptionThe remote OracleVM system is missing necessary patches to address critical security updates : - add disable monitor to default ntp.conf [CVE-2013-5211] - don
    last seen2020-06-01
    modified2020-06-02
    plugin id97058
    published2017-02-08
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97058
    titleOracleVM 3.3 / 3.4 : ntp (OVMSA-2017-0038)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-0255-1.NASL
    descriptionThis update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed : - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: NULL pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-8140: ntpq vulnerable to replay attacks. - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed : - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in
    last seen2020-06-01
    modified2020-06-02
    plugin id96715
    published2017-01-24
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96715
    titleSUSE SLES11 Security Update : ntp (SUSE-SU-2017:0255-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3196-1.NASL
    descriptionThis update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed : - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: NULL pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed : - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in
    last seen2020-06-01
    modified2020-06-02
    plugin id95988
    published2016-12-21
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95988
    titleSUSE SLES12 Security Update : ntp (SUSE-SU-2016:3196-1)
  • NASL familyAmazon Linux Local Security Checks
    NASL idAL2_ALAS-2018-1009.NASL
    descriptionEphemeral association time spoofing additional protection ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim
    last seen2020-06-01
    modified2020-06-02
    plugin id109688
    published2018-05-11
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109688
    titleAmazon Linux 2 : ntp (ALAS-2018-1009)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-0252.NASL
    descriptionFrom Red Hat Security Advisory 2017:0252 : An update for ntp is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Network Time Protocol (NTP) is used to synchronize a computer
    last seen2020-06-01
    modified2020-06-02
    plugin id97036
    published2017-02-07
    reporterThis script is Copyright (C) 2017 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/97036
    titleOracle Linux 6 / 7 : ntp (ELSA-2017-0252)
  • NASL familyAIX Local Security Checks
    NASL idAIX_IV92194.NASL
    descriptionNTPv3 and NTPv4 are vulnerable to : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7427 NTP is vulnerable to a denial of service, caused by an error in broadcast mode replay prevention functionality. By sending specially crafted NTP packets, a local attacker could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in broadcast mode poll interval enforcement functionality. By sending specially crafted NTP packets, a remote attacker from within the local network could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in the control mode (mode 6) functionality. By sending specially crafted control mode packets, a remote attacker could exploit this vulnerability to obtain sensitive information and cause the application to crash. NTP is vulnerable to a denial of service, caused by a NULL pointer dereference when trap service has been enabled. By sending specially crafted packets, a remote attacker could exploit this vulnerability to cause the application to crash. This plugin has been deprecated to better accommodate iFix supersedence with replacement plugin aix_ntp_v3_advisory8.nasl (plugin id 102129).
    last seen2017-10-29
    modified2017-08-03
    plugin id97230
    published2017-02-21
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=97230
    titleAIX 5.3 TL 12 : ntp (IV92194) (deprecated)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3349-1.NASL
    descriptionYihan Lian discovered that NTP incorrectly handled certain large request data values. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-2519) Miroslav Lichvar discovered that NTP incorrectly handled certain spoofed addresses when performing rate limiting. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7426) Matthew Van Gundy discovered that NTP incorrectly handled certain crafted broadcast mode packets. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7427, CVE-2016-7428) Miroslav Lichvar discovered that NTP incorrectly handled certain responses. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7429) Sharon Goldberg and Aanchal Malhotra discovered that NTP incorrectly handled origin timestamps of zero. A remote attacker could possibly use this issue to bypass the origin timestamp protection mechanism. This issue only affected Ubuntu 16.10. (CVE-2016-7431) Brian Utterback, Sharon Goldberg and Aanchal Malhotra discovered that NTP incorrectly performed initial sync calculations. This issue only applied to Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7433) Magnus Stubman discovered that NTP incorrectly handled certain mrulist queries. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7434) Matthew Van Gund discovered that NTP incorrectly handled origin timestamp checks. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu Ubuntu 16.10, and Ubuntu 17.04. (CVE-2016-9042) Matthew Van Gundy discovered that NTP incorrectly handled certain control mode packets. A remote attacker could use this issue to set or unset traps. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9310) Matthew Van Gundy discovered that NTP incorrectly handled the trap service. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9311) It was discovered that NTP incorrectly handled memory when processing long variables. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2017-6458) It was discovered that NTP incorrectly handled memory when processing long variables. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-6460) It was discovered that the NTP legacy DPTS refclock driver incorrectly handled the /dev/datum device. A local attacker could possibly use this issue to cause a denial of service. (CVE-2017-6462) It was discovered that NTP incorrectly handled certain invalid settings in a :config directive. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2017-6463) It was discovered that NTP incorrectly handled certain invalid mode configuration directives. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2017-6464). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id101263
    published2017-07-06
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101263
    titleUbuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : ntp vulnerabilities (USN-3349-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-0252.NASL
    descriptionAn update for ntp is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Network Time Protocol (NTP) is used to synchronize a computer
    last seen2020-06-01
    modified2020-06-02
    plugin id97011
    published2017-02-06
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97011
    titleRHEL 6 / 7 : ntp (RHSA-2017:0252)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-0252.NASL
    descriptionAn update for ntp is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Network Time Protocol (NTP) is used to synchronize a computer
    last seen2020-06-01
    modified2020-06-02
    plugin id97026
    published2017-02-07
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97026
    titleCentOS 6 / 7 : ntp (CESA-2017:0252)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3195-1.NASL
    descriptionThis update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed : - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: NULL pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed : - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in
    last seen2020-06-01
    modified2020-06-02
    plugin id95987
    published2016-12-21
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95987
    titleSUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2016:3195-1)
  • NASL familyAIX Local Security Checks
    NASL idAIX_IV92067.NASL
    descriptionNTPv3 and NTPv4 are vulnerable to : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7427 NTP is vulnerable to a denial of service, caused by an error in broadcast mode replay prevention functionality. By sending specially crafted NTP packets, a local attacker could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in broadcast mode poll interval enforcement functionality. By sending specially crafted NTP packets, a remote attacker from within the local network could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in the control mode (mode 6) functionality. By sending specially crafted control mode packets, a remote attacker could exploit this vulnerability to obtain sensitive information and cause the application to crash. NTP is vulnerable to a denial of service, caused by a NULL pointer dereference when trap service has been enabled. By sending specially crafted packets, a remote attacker could exploit this vulnerability to cause the application to crash. This plugin has been deprecated to better accommodate iFix supersedence with replacement plugin aix_ntp_v3_advisory8.nasl (plugin id 102129).
    last seen2017-10-29
    modified2017-08-03
    plugin id97228
    published2017-02-21
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=97228
    titleAIX 7.2 TL 1 : ntp (IV92067) (deprecated)
  • NASL familyAIX Local Security Checks
    NASL idAIX_IV91803.NASL
    descriptionNTPv3 and NTPv4 are vulnerable to : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7427 NTP is vulnerable to a denial of service, caused by an error in broadcast mode replay prevention functionality. By sending specially crafted NTP packets, a local attacker could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in broadcast mode poll interval enforcement functionality. By sending specially crafted NTP packets, a remote attacker from within the local network could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in the control mode (mode 6) functionality. By sending specially crafted control mode packets, a remote attacker could exploit this vulnerability to obtain sensitive information and cause the application to crash. NTP is vulnerable to a denial of service, caused by a NULL pointer dereference when trap service has been enabled. By sending specially crafted packets, a remote attacker could exploit this vulnerability to cause the application to crash. This plugin has been deprecated to better accommodate iFix supersedence with replacement plugin aix_ntp_v3_advisory8.nasl (plugin id 102129).
    last seen2017-10-29
    modified2017-08-03
    plugin id97131
    published2017-02-14
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=97131
    titleAIX 6.1 TL 9 : ntp (IV91803) (deprecated)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-7209AB4E02.NASL
    descriptionSecurity fix for CVE-2016-7433, CVE-2016-7426, CVE-2016-7429, CVE-2016-9310, CVE-2016-9311 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-12-08
    plugin id95612
    published2016-12-08
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95612
    titleFedora 25 : ntp (2016-7209ab4e02)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_FCEDCDBBC86E11E6B1CF14DAE9D210B8.NASL
    descriptionMultiple vulnerabilities have been discovered in the NTP suite : CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-9310: Mode 6 unauthenticated trap information disclosure and DDoS vector. Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-7427: Broadcast Mode Replay Prevention DoS. Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-7428: Broadcast Mode Poll Interval Enforcement DoS. Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-7431: Regression: 010-origin: Zero Origin Timestamp Bypass. Reported by Sharon Goldberg and Aanchal Malhotra of Boston University. CVE-2016-7434: NULL pointer dereference in _IO_str_init_static_internal(). Reported by Magnus Stubman. CVE-2016-7426: Client rate limiting and server responses. Reported by Miroslav Lichvar of Red Hat. CVE-2016-7433: Reboot sync calculation problem. Reported independently by Brian Utterback of Oracle, and by Sharon Goldberg and Aanchal Malhotra of Boston University. Impact : A remote attacker who can send a specially crafted packet to cause a NULL pointer dereference that will crash ntpd, resulting in a Denial of Service. [CVE-2016-9311] An exploitable configuration modification vulnerability exists in the control mode (mode 6) functionality of ntpd. If, against long-standing BCP recommendations,
    last seen2020-06-01
    modified2020-06-02
    plugin id96123
    published2016-12-27
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96123
    titleFreeBSD : FreeBSD -- Multiple vulnerabilities of ntp (fcedcdbb-c86e-11e6-b1cf-14dae9d210b8)
  • NASL familyVirtuozzo Local Security Checks
    NASL idVIRTUOZZO_VZLSA-2017-0252.NASL
    descriptionAn update for ntp is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Network Time Protocol (NTP) is used to synchronize a computer
    last seen2020-06-01
    modified2020-06-02
    plugin id101419
    published2017-07-13
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101419
    titleVirtuozzo 6 : ntp / ntp-doc / ntp-perl / ntpdate (VZLSA-2017-0252)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1024.NASL
    descriptionAccording to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources. A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid responses from its sources. (CVE-2016-7426) - A flaw was found in the control mode functionality of ntpd. A remote attacker could send a crafted control mode packet which could lead to information disclosure or result in DDoS amplification attacks. (CVE-2016-9310) - A flaw was found in the way ntpd implemented the trap service. A remote attacker could send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service. (CVE-2016-9311) - A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source. (CVE-2016-7429) - A flaw was found in the way ntpd calculated the root delay. A remote attacker could send a specially-crafted spoofed packet to cause denial of service or in some special cases even crash. (CVE-2016-7433) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99869
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99869
    titleEulerOS 2.0 SP2 : ntp (EulerOS-SA-2017-1024)
  • NASL familyAIX Local Security Checks
    NASL idAIX_IV91951.NASL
    descriptionNTPv3 and NTPv4 are vulnerable to : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7427 NTP is vulnerable to a denial of service, caused by an error in broadcast mode replay prevention functionality. By sending specially crafted NTP packets, a local attacker could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in broadcast mode poll interval enforcement functionality. By sending specially crafted NTP packets, a remote attacker from within the local network could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in the control mode (mode 6) functionality. By sending specially crafted control mode packets, a remote attacker could exploit this vulnerability to obtain sensitive information and cause the application to crash. NTP is vulnerable to a denial of service, caused by a NULL pointer dereference when trap service has been enabled. By sending specially crafted packets, a remote attacker could exploit this vulnerability to cause the application to crash. This plugin has been deprecated to better accommodate iFix supersedence with replacement plugin aix_ntp_v3_advisory8.nasl (plugin id 102129).
    last seen2017-10-29
    modified2017-08-03
    plugin id97132
    published2017-02-14
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=97132
    titleAIX 7.1 TL 4 : ntp (IV91951) (deprecated)
  • NASL familyMisc.
    NASL idNTP_4_2_8P9.NASL
    descriptionThe version of the remote NTP server is 4.x prior to 4.2.8p9. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists when rate limiting is configured for all associations, the limits also being applied to responses received from the configured sources. An unauthenticated, remote attacker can exploit this, by periodically sending spoofed packets, to keep rate limiting active, resulting in valid responses not being accepted by ntpd from its sources. (CVE-2016-7426) - A denial of service vulnerability exists in the broadcast mode replay prevention functionality. An unauthenticated, adjacent attacker can exploit this, via specially crafted broadcast mode NTP packets periodically injected into the broadcast domain, to cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers. (CVE-2016-7427) - A denial of service vulnerability exists in the broadcast mode poll interval functionality. An unauthenticated, adjacent attacker can exploit this, via specially crafted broadcast mode NTP packets, to cause ntpd to reject packets from a legitimate NTP broadcast server. (CVE-2016-7428) - A denial of service vulnerability exists when receiving server responses on sockets that correspond to different interfaces than what were used in the request. An unauthenticated, remote attacker can exploit this, by sending repeated requests using specially crafted packets with spoofed source addresses, to cause ntpd to select the incorrect interface for the source, which prevents it from sending new requests until the interface list is refreshed. This eventually results in preventing ntpd from synchronizing with the source. (CVE-2016-7429) - A flaw exists that allows packets with an origin timestamp of zero to bypass security checks. An unauthenticated, remote attacker can exploit this to spoof arbitrary content. (CVE-2016-7431) - A flaw exists due to the root delay being included twice, which may result in the jitter value being higher than expected. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7433) - A denial of service vulnerability exists when handling specially crafted mrulist query packets that allows an unauthenticated, remote attacker to crash ntpd. (CVE-2016-7434) - A flaw exists in the control mode (mode 6) functionality when handling specially crafted control mode packets. An unauthenticated, adjacent attacker can exploit this to set or disable ntpd traps, resulting in the disclosure of potentially sensitive information, disabling of legitimate monitoring, or DDoS amplification. (CVE-2016-9310) - A NULL pointer dereference flaw exists in the report_event() function within file ntpd/ntp_control.c when the trap service handles certain peer events. An unauthenticated, remote attacker can exploit this, via a specially crafted packet, to cause a denial of service condition. (CVE-2016-9311) - A denial of service vulnerability exists when handling oversize UDP packets that allows an unauthenticated, remote attacker to crash ntpd. Note that this vulnerability only affects Windows versions. (CVE-2016-9312)
    last seen2020-04-30
    modified2016-12-06
    plugin id95575
    published2016-12-06
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95575
    titleNetwork Time Protocol Daemon (ntpd) 4.x < 4.2.8p9 Multiple Vulnerabilities
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0003.NASL
    descriptionAn update of [guile,ntp] packages for PhotonOS has been released.
    last seen2019-02-08
    modified2019-02-07
    plugin id111852
    published2018-08-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=111852
    titlePhoton OS 1.0: Guile / Ntp / Ntpstat PHSA-2017-0003 (deprecated)
  • NASL familyAIX Local Security Checks
    NASL idAIX_IV92193.NASL
    descriptionNTPv3 and NTPv4 are vulnerable to : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7427 NTP is vulnerable to a denial of service, caused by an error in broadcast mode replay prevention functionality. By sending specially crafted NTP packets, a local attacker could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in broadcast mode poll interval enforcement functionality. By sending specially crafted NTP packets, a remote attacker from within the local network could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in the control mode (mode 6) functionality. By sending specially crafted control mode packets, a remote attacker could exploit this vulnerability to obtain sensitive information and cause the application to crash. NTP is vulnerable to a denial of service, caused by a NULL pointer dereference when trap service has been enabled. By sending specially crafted packets, a remote attacker could exploit this vulnerability to cause the application to crash. This plugin has been deprecated to better accommodate iFix supersedence with replacement plugin aix_ntp_v3_advisory8.nasl (plugin id 102129).
    last seen2017-10-29
    modified2017-08-03
    plugin id97229
    published2017-02-21
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=97229
    titleAIX 7.1 TL 3 : ntp (IV92193) (deprecated)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-C198D15316.NASL
    descriptionSecurity fix for CVE-2016-7433, CVE-2016-7426, CVE-2016-7429, CVE-2016-9310, CVE-2016-9311 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-12-08
    plugin id95615
    published2016-12-08
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95615
    titleFedora 24 : ntp (2016-c198d15316)
  • NASL familyAIX Local Security Checks
    NASL idAIX_NTP_V4_ADVISORY8.NASL
    descriptionThe version of NTP installed on the remote AIX host is affected by the following vulnerabilities : - A denial of service vulnerability exists in the broadcast mode replay prevention functionality. An unauthenticated, adjacent attacker can exploit this, via specially crafted broadcast mode NTP packets periodically injected into the broadcast domain, to cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers. (CVE-2016-7427) - A denial of service vulnerability exists in the broadcast mode poll interval functionality. An unauthenticated, adjacent attacker can exploit this, via specially crafted broadcast mode NTP packets, to cause ntpd to reject packets from a legitimate NTP broadcast server. (CVE-2016-7428) - A flaw exists in the control mode (mode 6) functionality when handling specially crafted control mode packets. An unauthenticated, adjacent attacker can exploit this to set or disable ntpd traps, resulting in the disclosure of potentially sensitive information, disabling of legitimate monitoring, or DDoS amplification. (CVE-2016-9310) - A NULL pointer dereference flaw exists in the report_event() function within file ntpd/ntp_control.c when the trap service handles certain peer events. An unauthenticated, remote attacker can exploit this, via a specially crafted packet, to cause a denial of service condition. (CVE-2016-9311)
    last seen2020-06-01
    modified2020-06-02
    plugin id99184
    published2017-04-04
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/99184
    titleAIX NTP v4 Advisory : ntp_advisory8.asc (IV92126) (IV92287)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170206_NTP_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources. A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid responses from its sources. (CVE-2016-7426) - A flaw was found in the control mode functionality of ntpd. A remote attacker could send a crafted control mode packet which could lead to information disclosure or result in DDoS amplification attacks. (CVE-2016-9310) - A flaw was found in the way ntpd implemented the trap service. A remote attacker could send a specially crafted packet to cause a NULL pointer dereference that will crash ntpd, resulting in a denial of service. (CVE-2016-9311) - A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source. (CVE-2016-7429) - A flaw was found in the way ntpd calculated the root delay. A remote attacker could send a specially crafted spoofed packet to cause denial of service or in some special cases even crash. (CVE-2016-7433)
    last seen2020-03-18
    modified2017-02-07
    plugin id97039
    published2017-02-07
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97039
    titleScientific Linux Security Update : ntp on SL6.x, SL7.x i386/x86_64 (20170206)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2017-781.NASL
    descriptionThe following security-related issues were resolved : CVE-2016-7426 : Client rate limiting and server responses CVE-2016-7429 : Attack on interface selection CVE-2016-7433 : Broken initial sync calculations regression CVE-2016-9310 : Mode 6 unauthenticated trap information disclosure and DDoS vector CVE-2016-9311 : NULL pointer dereference when trap service is enabled
    last seen2020-06-01
    modified2020-06-02
    plugin id96283
    published2017-01-05
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/96283
    titleAmazon Linux AMI : ntp (ALAS-2017-781)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3193-1.NASL
    descriptionThis update for ntp fixes the following issues : - Simplify ntpd
    last seen2020-06-01
    modified2020-06-02
    plugin id95986
    published2016-12-21
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95986
    titleSUSE SLES11 Security Update : ntp (SUSE-SU-2016:3193-1)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_8DB8D62AB08B11E68EBAD050996490D0.NASL
    descriptionNetwork Time Foundation reports : NTF
    last seen2020-06-01
    modified2020-06-02
    plugin id95265
    published2016-11-23
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95265
    titleFreeBSD : ntp -- multiple vulnerabilities (8db8d62a-b08b-11e6-8eba-d050996490d0)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0114_NTP.NASL
    descriptionThe remote NewStart CGSL host, running version MAIN 4.05, has ntp packages installed that are affected by multiple vulnerabilities: - It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources. A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid responses from its sources. (CVE-2016-7426) - A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source. (CVE-2016-7429) - A flaw was found in the way ntpd calculated the root delay. A remote attacker could send a specially-crafted spoofed packet to cause denial of service or in some special cases even crash. (CVE-2016-7433) - A flaw was found in the control mode functionality of ntpd. A remote attacker could send a crafted control mode packet which could lead to information disclosure or result in DDoS amplification attacks. (CVE-2016-9310) - A flaw was found in the way ntpd implemented the trap service. A remote attacker could send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service. (CVE-2016-9311) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id127353
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127353
    titleNewStart CGSL MAIN 4.05 : ntp Multiple Vulnerabilities (NS-SA-2019-0114)
  • NASL familyAIX Local Security Checks
    NASL idAIX_NTP_V3_ADVISORY8.NASL
    descriptionThe version of NTP installed on the remote AIX host is affected by the following vulnerabilities : - A denial of service vulnerability exists in the broadcast mode replay prevention functionality. An unauthenticated, adjacent attacker can exploit this, via specially crafted broadcast mode NTP packets periodically injected into the broadcast domain, to cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers. (CVE-2016-7427) - A denial of service vulnerability exists in the broadcast mode poll interval functionality. An unauthenticated, adjacent attacker can exploit this, via specially crafted broadcast mode NTP packets, to cause ntpd to reject packets from a legitimate NTP broadcast server. (CVE-2016-7428) - A flaw exists in the control mode (mode 6) functionality when handling specially crafted control mode packets. An unauthenticated, adjacent attacker can exploit this to set or disable ntpd traps, resulting in the disclosure of potentially sensitive information, disabling of legitimate monitoring, or DDoS amplification. (CVE-2016-9310) - A NULL pointer dereference flaw exists in the report_event() function within file ntpd/ntp_control.c when the trap service handles certain peer events. An unauthenticated, remote attacker can exploit this, via a specially crafted packet, to cause a denial of service condition. (CVE-2016-9311)
    last seen2020-06-01
    modified2020-06-02
    plugin id102129
    published2017-08-03
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/102129
    titleAIX NTP v3 Advisory : ntp_advisory8.asc (IV92194) (IV91803) (IV92193) (IV91951) (IV92192) (IV92067)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0003_NTP.NASL
    descriptionAn update of the ntp package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id121668
    published2019-02-07
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121668
    titlePhoton OS 1.0: Ntp PHSA-2017-0003
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-1525.NASL
    descriptionThis update for ntp fixes the following issues : ntp was updated to 4.2.8p9. Security issues fixed : - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: NULL pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed : - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in
    last seen2020-06-05
    modified2016-12-29
    plugin id96173
    published2016-12-29
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96173
    titleopenSUSE Security Update : ntp (openSUSE-2016-1525)
  • NASL familyFirewalls
    NASL idPFSENSE_SA-17_03.NASL
    descriptionAccording to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories.
    last seen2020-06-01
    modified2020-06-02
    plugin id106503
    published2018-01-31
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/106503
    titlepfSense < 2.3.3 Multiple Vulnerabilities (SA-17_01 - SA-17_03)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1556.NASL
    descriptionAccording to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was discovered in the NTP server
    last seen2020-06-01
    modified2020-06-02
    plugin id125009
    published2019-05-14
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125009
    titleEulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1556)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1023.NASL
    descriptionAccording to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources. A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid responses from its sources. (CVE-2016-7426) - A flaw was found in the control mode functionality of ntpd. A remote attacker could send a crafted control mode packet which could lead to information disclosure or result in DDoS amplification attacks. (CVE-2016-9310) - A flaw was found in the way ntpd implemented the trap service. A remote attacker could send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service. (CVE-2016-9311) - A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source. (CVE-2016-7429) - A flaw was found in the way ntpd calculated the root delay. A remote attacker could send a specially-crafted spoofed packet to cause denial of service or in some special cases even crash. (CVE-2016-7433) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99868
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99868
    titleEulerOS 2.0 SP1 : ntp (EulerOS-SA-2017-1023)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0003_NTPSTAT.NASL
    descriptionAn update of the ntpstat package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id121669
    published2019-02-07
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121669
    titlePhoton OS 1.0: Ntpstat PHSA-2017-0003
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-E8A8561EE7.NASL
    descriptionSecurity fix for CVE-2016-7433, CVE-2016-7426, CVE-2016-7429, CVE-2016-9310, CVE-2016-9311 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-12-08
    plugin id95616
    published2016-12-08
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95616
    titleFedora 23 : ntp (2016-e8a8561ee7)
  • NASL familyAIX Local Security Checks
    NASL idAIX_IV92192.NASL
    descriptionNTPv3 and NTPv4 are vulnerable to : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7427 NTP is vulnerable to a denial of service, caused by an error in broadcast mode replay prevention functionality. By sending specially crafted NTP packets, a local attacker could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in broadcast mode poll interval enforcement functionality. By sending specially crafted NTP packets, a remote attacker from within the local network could exploit this vulnerability to cause a denial of service. NTP is vulnerable to a denial of service, caused by an error in the control mode (mode 6) functionality. By sending specially crafted control mode packets, a remote attacker could exploit this vulnerability to obtain sensitive information and cause the application to crash. NTP is vulnerable to a denial of service, caused by a NULL pointer dereference when trap service has been enabled. By sending specially crafted packets, a remote attacker could exploit this vulnerability to cause the application to crash. This plugin has been deprecated to better accommodate iFix supersedence with replacement plugin aix_ntp_v3_advisory8.nasl (plugin id 102129).
    last seen2017-10-29
    modified2017-08-03
    plugin id97133
    published2017-02-14
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=97133
    titleAIX 7.2 TL 0 : ntp (IV92192) (deprecated)

Redhat

advisories
bugzilla
id1398350
titleCVE-2016-9311 ntp: Null pointer dereference when trap service is enabled
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 6 is installed
      ovaloval:com.redhat.rhba:tst:20111656003
    • OR
      • AND
        • commentntp-doc is earlier than 0:4.2.6p5-10.el6_8.2
          ovaloval:com.redhat.rhsa:tst:20170252001
        • commentntp-doc is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20142024004
      • AND
        • commentntp-perl is earlier than 0:4.2.6p5-10.el6_8.2
          ovaloval:com.redhat.rhsa:tst:20170252003
        • commentntp-perl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20142024002
      • AND
        • commentntp is earlier than 0:4.2.6p5-10.el6_8.2
          ovaloval:com.redhat.rhsa:tst:20170252005
        • commentntp is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20142024006
      • AND
        • commentntpdate is earlier than 0:4.2.6p5-10.el6_8.2
          ovaloval:com.redhat.rhsa:tst:20170252007
        • commentntpdate is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20142024008
  • AND
    • commentRed Hat Enterprise Linux 7 is installed
      ovaloval:com.redhat.rhba:tst:20150364027
    • OR
      • AND
        • commentsntp is earlier than 0:4.2.6p5-25.el7_3.1
          ovaloval:com.redhat.rhsa:tst:20170252010
        • commentsntp is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20142024013
      • AND
        • commentntp-doc is earlier than 0:4.2.6p5-25.el7_3.1
          ovaloval:com.redhat.rhsa:tst:20170252012
        • commentntp-doc is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20142024004
      • AND
        • commentntp-perl is earlier than 0:4.2.6p5-25.el7_3.1
          ovaloval:com.redhat.rhsa:tst:20170252013
        • commentntp-perl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20142024002
      • AND
        • commentntpdate is earlier than 0:4.2.6p5-25.el7_3.1
          ovaloval:com.redhat.rhsa:tst:20170252014
        • commentntpdate is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20142024008
      • AND
        • commentntp is earlier than 0:4.2.6p5-25.el7_3.1
          ovaloval:com.redhat.rhsa:tst:20170252015
        • commentntp is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20142024006
rhsa
idRHSA-2017:0252
released2017-02-06
severityModerate
titleRHSA-2017:0252: ntp security update (Moderate)
rpms
  • ntp-0:4.2.6p5-10.el6_8.2
  • ntp-0:4.2.6p5-25.el7_3.1
  • ntp-debuginfo-0:4.2.6p5-10.el6_8.2
  • ntp-debuginfo-0:4.2.6p5-25.el7_3.1
  • ntp-doc-0:4.2.6p5-10.el6_8.2
  • ntp-doc-0:4.2.6p5-25.el7_3.1
  • ntp-perl-0:4.2.6p5-10.el6_8.2
  • ntp-perl-0:4.2.6p5-25.el7_3.1
  • ntpdate-0:4.2.6p5-10.el6_8.2
  • ntpdate-0:4.2.6p5-25.el7_3.1
  • sntp-0:4.2.6p5-25.el7_3.1

Seebug

bulletinFamilyexploit
description### Summary An exploitable denial of service vulnerability exists in the trap functionality of ntpd. If an ntpd instance is configured to send traps, a specially crafted network packet can be used to cause a null pointer dereference resulting in a denial of service. This vulnerability can be triggered by a remote unauthenticated attacker. ### Tested Versions * NTP 4.2.8p8 * NTPsec 0.9.3 ### Product URLs * http://www.ntp.org * http://www.ntpsec.org/ ### CVSS Scores CVSSv2: 7.1 - (AV:N/AC:M/Au:N/C:N/I:N/A:C) CVSSv3: 5.9 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H ### Details When reporting traps, the ntpd reportevent(err, peer, str) function asserts that peer != NULL if err is a "peer event". Thus if reportevent() can be called with NULL peer parameter, ntpd will abort() causing a DoS condition. ntp-4.2.8p7 introduced a variety of validity checks on crypto-NAK packets to address the nak-dos vulnerability (CVE-2016-1547). When any of these validity checks fail, ntpd reports an event to any trap receivers with: reportevent(PEVNTAUTH, peer, "Invalid_NAK"). If the source address and mode of the incoming crypto-NAK packet do not correspond to an existing peer, the peer argument will be NULL causing the INSIST(peer != NULL) assertion to fail when report_event() attempts to report the event to its trap recipients. It may also be possible to trigger reporting of a peer event without a valid peer on other code paths. For example, checkleapsec() in ntptimer.c calls: ``` report_event(PEVNT_ARMED, sys_peer, NULL); ``` If ntpd's syspeer advertises a leap second and then the host running ntpd becomes temporarily disconnected, it may be possible for checkleapsec() to be called without a valid sys_peer leading to the assertion failure above. This crash can be reliably triggered on ntp-4.2.8p8. We are reporting this defect against NTPsec 0.9.3 as well because it contains the same incorrect logic in reportevent(). However we did not attempt to exploit this vulnerability on NTPsec because triggering a call to reportevent() with a NULL peer is not as straightforward as with ntp-4.2.8p8. The fix for CRYPTO_NAK crash (CVE-2016-4957) introduced in ntp-4.2.8p8 does not address this vulnerability. Though traps are not configured in most common NTP environments, attackers can employ "Network Time Protocol Control Mode Unauthenticated Trap Information Disclosure and DDoS Amplification Vulnerability" (TALOS-2016-0203) in order to configure a trap in order to exploit this vulnerability. ### Mitigation Successful exploitation of this vulnerability requires ntpd to be configured with trap recipients. Systems can be protected by removing all "trap" commands from ntp.conf and adopting the mitigations for "Network Time Protocol Control Mode Unauthenticated Trap Information Disclosure and DDoS Amplification Vulnerability" (TALOS-2016-0203). ### Timeline * 2016-09-20 - Vendor Disclosure * 2016-11-21 - Public Release
idSSV:96649
last seen2017-11-19
modified2017-10-11
published2017-10-11
reporterRoot
titleNetwork Time Protocol Trap Crash Denial of Service Vulnerability(CVE-2016-9311)

Talos

idTALOS-2016-0204
last seen2019-05-29
published2016-11-21
reporterTalos Intelligence
sourcehttp://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0204
titleNetwork Time Protocol Trap Crash Denial of Service Vulnerability

References