CVE-2016-2517

2017-01-3021:59:00

Debian Security Bug Tracker

security-tracker.debian.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.9 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:N/I:N/A:C

0.005 Low

EPSS

Percentile

75.5%

JSON

NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression.

OSVersionArchitecturePackageVersionFilename
Debian11allntp< 1:4.2.8p7+dfsg-1ntp_1:4.2.8p7+dfsg-1_all.deb
Debian10allntp< 1:4.2.8p7+dfsg-1ntp_1:4.2.8p7+dfsg-1_all.deb