Lucene search

[email protected]NVD:CVE-2016-2517

HistoryJan 30, 2017 - 9:59 p.m.

CVE-2016-2517

2017-01-3021:59:01

CWE-20

[email protected]

web.nvd.nist.gov

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:N/I:N/A:C

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.1

Confidence

High

EPSS

0.018

Percentile

88.3%

JSON

NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression.

Affected configurations

Nvd

Node

ntpntpRange≤4.2.8p6

Node

ntpntpMatch4.3.0

ntpntpMatch4.3.1

ntpntpMatch4.3.2

ntpntpMatch4.3.3

ntpntpMatch4.3.4

ntpntpMatch4.3.5

ntpntpMatch4.3.6

ntpntpMatch4.3.7

ntpntpMatch4.3.8

ntpntpMatch4.3.9

ntpntpMatch4.3.10

ntpntpMatch4.3.11

ntpntpMatch4.3.12

ntpntpMatch4.3.13

ntpntpMatch4.3.14

ntpntpMatch4.3.15

ntpntpMatch4.3.16

ntpntpMatch4.3.17

ntpntpMatch4.3.18

ntpntpMatch4.3.19

ntpntpMatch4.3.20

ntpntpMatch4.3.21

ntpntpMatch4.3.22

ntpntpMatch4.3.23

ntpntpMatch4.3.24

ntpntpMatch4.3.25

ntpntpMatch4.3.26

ntpntpMatch4.3.27

ntpntpMatch4.3.28

ntpntpMatch4.3.29

ntpntpMatch4.3.30

ntpntpMatch4.3.31

ntpntpMatch4.3.32

ntpntpMatch4.3.33

ntpntpMatch4.3.34

ntpntpMatch4.3.35

ntpntpMatch4.3.36

ntpntpMatch4.3.37

ntpntpMatch4.3.38

ntpntpMatch4.3.39

ntpntpMatch4.3.40

ntpntpMatch4.3.41

ntpntpMatch4.3.42

ntpntpMatch4.3.43

ntpntpMatch4.3.44

ntpntpMatch4.3.45

ntpntpMatch4.3.46

ntpntpMatch4.3.47

ntpntpMatch4.3.48

ntpntpMatch4.3.49

ntpntpMatch4.3.50

ntpntpMatch4.3.51

ntpntpMatch4.3.52

ntpntpMatch4.3.53

ntpntpMatch4.3.54

ntpntpMatch4.3.55

ntpntpMatch4.3.56

ntpntpMatch4.3.57

ntpntpMatch4.3.58

ntpntpMatch4.3.59

ntpntpMatch4.3.60

ntpntpMatch4.3.61

ntpntpMatch4.3.62

ntpntpMatch4.3.63

ntpntpMatch4.3.64

ntpntpMatch4.3.65

ntpntpMatch4.3.66

ntpntpMatch4.3.67

ntpntpMatch4.3.68

ntpntpMatch4.3.69

ntpntpMatch4.3.70

ntpntpMatch4.3.71

ntpntpMatch4.3.72

ntpntpMatch4.3.73

ntpntpMatch4.3.74

ntpntpMatch4.3.75

ntpntpMatch4.3.76

ntpntpMatch4.3.77

ntpntpMatch4.3.78

ntpntpMatch4.3.79

ntpntpMatch4.3.80

ntpntpMatch4.3.81

ntpntpMatch4.3.82

ntpntpMatch4.3.83

ntpntpMatch4.3.84

ntpntpMatch4.3.85

ntpntpMatch4.3.86

ntpntpMatch4.3.87

ntpntpMatch4.3.88

ntpntpMatch4.3.89

ntpntpMatch4.3.90

ntpntpMatch4.3.91

References

support.ntp.org/bin/view/Main/NtpBug3010

www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

www.securityfocus.com/bid/88189

www.securitytracker.com/id/1035705

security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc

security.gentoo.org/glsa/201607-15

security.netapp.com/advisory/ntap-20171004-0002/

www.kb.cert.org/vuls/id/718152

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:N/I:N/A:C

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.1

Confidence

High

EPSS

0.018

Percentile

88.3%

JSON

Related for NVD:CVE-2016-2517