Lucene search

K

NTP Security Vulnerabilities

cve
cve

CVE-2017-6458

Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long...

8.8CVSS

8.5AI Score

0.005EPSS

2017-03-27 05:59 PM
87
7
cve
cve

CVE-2017-6459

The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null...

5.5CVSS

6.7AI Score

0.0004EPSS

2017-03-27 05:59 PM
46
cve
cve

CVE-2017-6451

The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory...

7.8CVSS

8.2AI Score

0.0004EPSS

2017-03-27 05:59 PM
58
4
cve
cve

CVE-2016-2519

ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data value, which triggers the ctl_getitem function to return a NULL...

5.9CVSS

6.5AI Score

0.046EPSS

2017-01-30 09:59 PM
71
cve
cve

CVE-2016-2516

NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times in an unconfig...

5.3CVSS

6AI Score

0.018EPSS

2017-01-30 09:59 PM
138
cve
cve

CVE-2016-2517

NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE:.....

5.3CVSS

6AI Score

0.018EPSS

2017-01-30 09:59 PM
74
cve
cve

CVE-2016-2518

The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode...

5.3CVSS

6.2AI Score

0.003EPSS

2017-01-30 09:59 PM
115
4
cve
cve

CVE-2015-7978

NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction...

7.5CVSS

7.3AI Score

0.085EPSS

2017-01-30 09:59 PM
111
cve
cve

CVE-2015-7975

The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service (application...

6.2CVSS

6.3AI Score

0.002EPSS

2017-01-30 09:59 PM
72
cve
cve

CVE-2015-7977

ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist...

5.9CVSS

6.3AI Score

0.016EPSS

2017-01-30 09:59 PM
113
2
cve
cve

CVE-2015-8138

NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to...

5.3CVSS

6.4AI Score

0.004EPSS

2017-01-30 09:59 PM
135
8
cve
cve

CVE-2015-7976

The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted...

4.3CVSS

5.6AI Score

0.004EPSS

2017-01-30 09:59 PM
111
cve
cve

CVE-2015-7973

NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the...

6.5CVSS

6.7AI Score

0.007EPSS

2017-01-30 09:59 PM
95
cve
cve

CVE-2015-8140

The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the...

4.8CVSS

5.9AI Score

0.034EPSS

2017-01-30 09:59 PM
77
cve
cve

CVE-2015-7979

NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast...

7.5CVSS

6.4AI Score

0.097EPSS

2017-01-30 09:59 PM
112
2
cve
cve

CVE-2015-8158

The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect...

5.9CVSS

6.2AI Score

0.012EPSS

2017-01-30 09:59 PM
104
cve
cve

CVE-2015-8139

ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified...

5.3CVSS

5.9AI Score

0.013EPSS

2017-01-30 09:59 PM
82
cve
cve

CVE-2016-1551

ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip...

3.7CVSS

5.4AI Score

0.005EPSS

2017-01-27 05:59 PM
51
cve
cve

CVE-2016-7431

NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero. NOTE: this vulnerability exists because of a CVE-2015-8138...

5.3CVSS

6.4AI Score

0.012EPSS

2017-01-13 04:59 PM
73
4
cve
cve

CVE-2016-9310

The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode...

6.5CVSS

6.4AI Score

0.008EPSS

2017-01-13 04:59 PM
91
4
cve
cve

CVE-2016-9312

ntpd in NTP before 4.2.8p9, when running on Windows, allows remote attackers to cause a denial of service via a large UDP...

7.5CVSS

7.1AI Score

0.63EPSS

2017-01-13 04:59 PM
61
cve
cve

CVE-2016-7427

The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via a crafted broadcast mode...

4.3CVSS

5.3AI Score

0.01EPSS

2017-01-13 04:59 PM
52
cve
cve

CVE-2016-9311

ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted...

5.9CVSS

6.3AI Score

0.022EPSS

2017-01-13 04:59 PM
110
4
cve
cve

CVE-2016-7428

ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast...

4.3CVSS

5.5AI Score

0.01EPSS

2017-01-13 04:59 PM
55
cve
cve

CVE-2016-7426

NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source...

7.5CVSS

6.4AI Score

0.058EPSS

2017-01-13 04:59 PM
89
cve
cve

CVE-2016-7434

The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist...

7.5CVSS

6.1AI Score

0.965EPSS

2017-01-13 04:59 PM
76
4
cve
cve

CVE-2016-7433

NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance that did not include the peer...

5.3CVSS

6.3AI Score

0.024EPSS

2017-01-13 04:59 PM
82
2
cve
cve

CVE-2016-7429

NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of service (prevent communication with a source) by sending a response for a source to an interface the source does not...

3.7CVSS

5.7AI Score

0.019EPSS

2017-01-13 04:59 PM
74
cve
cve

CVE-2016-1547

An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if...

5.3CVSS

6.3AI Score

0.006EPSS

2017-01-06 09:59 PM
116
cve
cve

CVE-2016-1550

An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest...

5.3CVSS

6.3AI Score

0.005EPSS

2017-01-06 09:59 PM
100
3
cve
cve

CVE-2016-1549

A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's...

6.5CVSS

6AI Score

0.001EPSS

2017-01-06 09:59 PM
63
cve
cve

CVE-2015-7848

An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to...

7.5CVSS

8.6AI Score

0.005EPSS

2017-01-06 09:59 PM
51
cve
cve

CVE-2016-1548

An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future...

7.2CVSS

6.3AI Score

0.006EPSS

2017-01-06 09:59 PM
97
4
cve
cve

CVE-2016-4957

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for...

7.5CVSS

6.2AI Score

0.923EPSS

2016-07-05 01:59 AM
46
cve
cve

CVE-2016-4956

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for...

5.3CVSS

6.4AI Score

0.023EPSS

2016-07-05 01:59 AM
91
11
cve
cve

CVE-2016-4955

ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain...

5.9CVSS

6.3AI Score

0.021EPSS

2016-07-05 01:59 AM
94
7
cve
cve

CVE-2016-4954

The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap...

7.5CVSS

6.9AI Score

0.026EPSS

2016-07-05 01:59 AM
84
6
cve
cve

CVE-2016-4953

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain...

7.5CVSS

7.3AI Score

0.033EPSS

2016-07-05 01:59 AM
78
6
cve
cve

CVE-2016-3989

The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root...

8.1CVSS

7.2AI Score

0.002EPSS

2016-07-03 02:59 PM
23
cve
cve

CVE-2016-3988

Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote.....

7.3CVSS

7.3AI Score

0.002EPSS

2016-07-03 02:59 PM
23
cve
cve

CVE-2016-3962

Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers....

7.3CVSS

7.3AI Score

0.002EPSS

2016-07-03 02:59 PM
30
cve
cve

CVE-2015-7974

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton...

7.7CVSS

7.6AI Score

0.003EPSS

2016-01-26 07:59 PM
106
3
cve
cve

CVE-2014-9751

The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by...

7.2AI Score

0.014EPSS

2015-10-06 01:59 AM
169
cve
cve

CVE-2014-9750

ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its...

6.8AI Score

0.01EPSS

2015-10-06 01:59 AM
138
cve
cve

CVE-2015-1799

The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing...

5.5AI Score

0.006EPSS

2015-04-08 10:59 AM
94
cve
cve

CVE-2015-1798

The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the...

5.5AI Score

0.006EPSS

2015-04-08 10:59 AM
88
cve
cve

CVE-2014-9296

The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted...

8.6AI Score

0.021EPSS

2014-12-20 02:59 AM
123
cve
cve

CVE-2014-9295

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure...

8AI Score

0.966EPSS

2014-12-20 02:59 AM
5381
cve
cve

CVE-2014-9294

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force...

7.4AI Score

0.044EPSS

2014-12-20 02:59 AM
5074
cve
cve

CVE-2014-9293

The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force...

7.4AI Score

0.044EPSS

2014-12-20 02:59 AM
168
Total number of security vulnerabilities107