Lucene search

[email protected]NVD:CVE-2016-2517

HistoryJan 30, 2017 - 9:59 p.m.

CVE-2016-2517

2017-01-3021:59:01

CWE-20

[email protected]

web.nvd.nist.gov

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:N/I:N/A:C

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

6.1 Medium

AI Score

Confidence

High

0.018 Low

EPSS

Percentile

88.2%

JSON

NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression.

Affected configurations

NVD

Node

ntpntpRange≤4.2.8p6

Node

ntpntpMatch4.3.0

ntpntpMatch4.3.1

ntpntpMatch4.3.2

ntpntpMatch4.3.3

ntpntpMatch4.3.4

ntpntpMatch4.3.5

ntpntpMatch4.3.6

ntpntpMatch4.3.7

ntpntpMatch4.3.8

ntpntpMatch4.3.9

ntpntpMatch4.3.10

ntpntpMatch4.3.11

ntpntpMatch4.3.12

ntpntpMatch4.3.13

ntpntpMatch4.3.14

ntpntpMatch4.3.15

ntpntpMatch4.3.16

ntpntpMatch4.3.17

ntpntpMatch4.3.18

ntpntpMatch4.3.19

ntpntpMatch4.3.20

ntpntpMatch4.3.21

ntpntpMatch4.3.22

ntpntpMatch4.3.23

ntpntpMatch4.3.24

ntpntpMatch4.3.25

ntpntpMatch4.3.26

ntpntpMatch4.3.27

ntpntpMatch4.3.28

ntpntpMatch4.3.29

ntpntpMatch4.3.30

ntpntpMatch4.3.31

ntpntpMatch4.3.32

ntpntpMatch4.3.33

ntpntpMatch4.3.34

ntpntpMatch4.3.35

ntpntpMatch4.3.36

ntpntpMatch4.3.37

ntpntpMatch4.3.38

ntpntpMatch4.3.39

ntpntpMatch4.3.40

ntpntpMatch4.3.41

ntpntpMatch4.3.42

ntpntpMatch4.3.43

ntpntpMatch4.3.44

ntpntpMatch4.3.45

ntpntpMatch4.3.46

ntpntpMatch4.3.47

ntpntpMatch4.3.48

ntpntpMatch4.3.49

ntpntpMatch4.3.50

ntpntpMatch4.3.51

ntpntpMatch4.3.52

ntpntpMatch4.3.53

ntpntpMatch4.3.54

ntpntpMatch4.3.55

ntpntpMatch4.3.56

ntpntpMatch4.3.57

ntpntpMatch4.3.58

ntpntpMatch4.3.59

ntpntpMatch4.3.60

ntpntpMatch4.3.61

ntpntpMatch4.3.62

ntpntpMatch4.3.63

ntpntpMatch4.3.64

ntpntpMatch4.3.65

ntpntpMatch4.3.66

ntpntpMatch4.3.67

ntpntpMatch4.3.68

ntpntpMatch4.3.69

ntpntpMatch4.3.70

ntpntpMatch4.3.71

ntpntpMatch4.3.72

ntpntpMatch4.3.73

ntpntpMatch4.3.74

ntpntpMatch4.3.75

ntpntpMatch4.3.76

ntpntpMatch4.3.77

ntpntpMatch4.3.78

ntpntpMatch4.3.79

ntpntpMatch4.3.80

ntpntpMatch4.3.81

ntpntpMatch4.3.82

ntpntpMatch4.3.83

ntpntpMatch4.3.84

ntpntpMatch4.3.85

ntpntpMatch4.3.86

ntpntpMatch4.3.87

ntpntpMatch4.3.88

ntpntpMatch4.3.89

ntpntpMatch4.3.90

ntpntpMatch4.3.91

References

support.ntp.org/bin/view/Main/NtpBug3010

www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

www.securityfocus.com/bid/88189

www.securitytracker.com/id/1035705

security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc

security.gentoo.org/glsa/201607-15

security.netapp.com/advisory/ntap-20171004-0002/

www.kb.cert.org/vuls/id/718152

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:N/I:N/A:C

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

6.1 Medium

AI Score

Confidence

High

0.018 Low

EPSS

Percentile

88.2%

JSON

Related for NVD:CVE-2016-2517