Lucene search

[email protected]NVD:CVE-2016-2518

HistoryJan 30, 2017 - 9:59 p.m.

CVE-2016-2518

2017-01-3021:59:01

CWE-125

[email protected]

web.nvd.nist.gov

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.2 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.9%

JSON

The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.

Affected configurations

NVD

Node

ntpntpRange<4.2.8

ntpntpRange4.3.0–4.3.92

ntpntpMatch4.2.8-

ntpntpMatch4.2.8p1

ntpntpMatch4.2.8p1-beta1

ntpntpMatch4.2.8p1-beta2

ntpntpMatch4.2.8p1-beta3

ntpntpMatch4.2.8p1-beta4

ntpntpMatch4.2.8p1-beta5

ntpntpMatch4.2.8p1-rc1

ntpntpMatch4.2.8p1-rc2

ntpntpMatch4.2.8p2

ntpntpMatch4.2.8p2-rc1

ntpntpMatch4.2.8p2-rc2

ntpntpMatch4.2.8p2-rc3

ntpntpMatch4.2.8p3

ntpntpMatch4.2.8p3-rc1

ntpntpMatch4.2.8p3-rc2

ntpntpMatch4.2.8p3-rc3

ntpntpMatch4.2.8p4

ntpntpMatch4.2.8p5

ntpntpMatch4.2.8p6

ntpntpMatch4.2.8p7

ntpntpMatch4.2.8p8

Node

debiandebian_linuxMatch8.0

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

Node

netappclustered_data_ontapMatch-

netappdata_ontapMatch-7-mode

netapponcommand_balanceMatch-

netapponcommand_performance_managerMatch-

netapponcommand_unified_manager_for_clustered_data_ontapMatch-

Node

oraclecommunications_user_data_repositoryMatch10.0.0

oraclecommunications_user_data_repositoryMatch10.0.1

oraclecommunications_user_data_repositoryMatch12.0.0

oraclelinuxMatch6-

oraclelinuxMatch7-

Node

redhatenterprise_linux_desktopMatch7.0

redhatenterprise_linux_serverMatch6.0

redhatenterprise_linux_serverMatch7.0

redhatenterprise_linux_server_ausMatch7.2

redhatenterprise_linux_server_ausMatch7.4

redhatenterprise_linux_server_ausMatch7.6

redhatenterprise_linux_server_eusMatch7.2

redhatenterprise_linux_server_eusMatch7.3

redhatenterprise_linux_server_eusMatch7.4

redhatenterprise_linux_server_eusMatch7.5

redhatenterprise_linux_server_eusMatch7.6

redhatenterprise_linux_server_eusMatch7.7

redhatenterprise_linux_server_tusMatch7.2

redhatenterprise_linux_server_tusMatch7.3

redhatenterprise_linux_server_tusMatch7.6

redhatenterprise_linux_server_tusMatch7.7

redhatenterprise_linux_workstationMatch6.0

Node

freebsdfreebsdMatch9.3-

freebsdfreebsdMatch9.3p1

freebsdfreebsdMatch9.3p10

freebsdfreebsdMatch9.3p12

freebsdfreebsdMatch9.3p13

freebsdfreebsdMatch9.3p16

freebsdfreebsdMatch9.3p19

freebsdfreebsdMatch9.3p2

freebsdfreebsdMatch9.3p20

freebsdfreebsdMatch9.3p21

freebsdfreebsdMatch9.3p22

freebsdfreebsdMatch9.3p23

freebsdfreebsdMatch9.3p24

freebsdfreebsdMatch9.3p25

freebsdfreebsdMatch9.3p28

freebsdfreebsdMatch9.3p3

freebsdfreebsdMatch9.3p30

freebsdfreebsdMatch9.3p31

freebsdfreebsdMatch9.3p32

freebsdfreebsdMatch9.3p33

freebsdfreebsdMatch9.3p34

freebsdfreebsdMatch9.3p35

freebsdfreebsdMatch9.3p36

freebsdfreebsdMatch9.3p38

freebsdfreebsdMatch9.3p39

freebsdfreebsdMatch9.3p5

freebsdfreebsdMatch9.3p6

freebsdfreebsdMatch9.3p7

freebsdfreebsdMatch9.3p8

freebsdfreebsdMatch9.3p9

freebsdfreebsdMatch10.1-

freebsdfreebsdMatch10.1p1

freebsdfreebsdMatch10.1p10

freebsdfreebsdMatch10.1p12

freebsdfreebsdMatch10.1p15

freebsdfreebsdMatch10.1p16

freebsdfreebsdMatch10.1p17

freebsdfreebsdMatch10.1p18

freebsdfreebsdMatch10.1p19

freebsdfreebsdMatch10.1p2

freebsdfreebsdMatch10.1p22

freebsdfreebsdMatch10.1p24

freebsdfreebsdMatch10.1p25

freebsdfreebsdMatch10.1p26

freebsdfreebsdMatch10.1p27

freebsdfreebsdMatch10.1p28

freebsdfreebsdMatch10.1p29

freebsdfreebsdMatch10.1p3

freebsdfreebsdMatch10.1p30

freebsdfreebsdMatch10.1p31

freebsdfreebsdMatch10.1p4

freebsdfreebsdMatch10.1p5

freebsdfreebsdMatch10.1p6

freebsdfreebsdMatch10.1p7

freebsdfreebsdMatch10.1p8

freebsdfreebsdMatch10.1p9

freebsdfreebsdMatch10.2-

freebsdfreebsdMatch10.2p1

freebsdfreebsdMatch10.2p10

freebsdfreebsdMatch10.2p11

freebsdfreebsdMatch10.2p12

freebsdfreebsdMatch10.2p13

freebsdfreebsdMatch10.2p14

freebsdfreebsdMatch10.2p2

freebsdfreebsdMatch10.2p5

freebsdfreebsdMatch10.2p7

freebsdfreebsdMatch10.2p8

freebsdfreebsdMatch10.2p9

freebsdfreebsdMatch10.3-

Node

siemenssimatic_net_cp_443-1_opc_ua_firmware

AND

siemenssimatic_net_cp_443-1_opc_uaMatch-

References

lists.fedoraproject.org/pipermail/package-announce/2016-May/183647.html

lists.fedoraproject.org/pipermail/package-announce/2016-May/184669.html

lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html

lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html

lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html

lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html

lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html

lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html

lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html

lists.opensuse.org/opensuse-updates/2016-05/msg00114.html

packetstormsecurity.com/files/136864/Slackware-Security-Advisory-ntp-Updates.html

rhn.redhat.com/errata/RHSA-2016-1552.html

support.ntp.org/bin/view/Main/NtpBug3009

support.ntp.org/bin/view/Main/SecurityNotice#April_2016_ntp_4_2_8p7_Security

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-ntpd

www.debian.org/security/2016/dsa-3629

www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

www.securityfocus.com/archive/1/538233/100/0/threaded

www.securityfocus.com/archive/1/archive/1/538233/100/0/threaded

www.securityfocus.com/bid/88226

www.securitytracker.com/id/1035705

www.ubuntu.com/usn/USN-3096-1

access.redhat.com/errata/RHSA-2016:1141

cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf

security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc

security.gentoo.org/glsa/201607-15

security.netapp.com/advisory/ntap-20171004-0002/

support.f5.com/csp/article/K20804323

us-cert.cisa.gov/ics/advisories/icsa-21-159-11

www.debian.org/security/2016/dsa-3629

www.kb.cert.org/vuls/id/718152

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.2 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.9%

JSON

Related for NVD:CVE-2016-2518