USN-3096-1: NTP vulnerabilities

Aanchal Malhotra discovered that NTP incorrectly handled authenticated broadcast mode. A remote attacker could use this issue to perform a replay attack. CVE-2015-7973 Matt Street discovered that NTP incorrectly verified peer associations of symmetric keys. A remote attacker could use this issue ...

Cisco IOS Denial of Service Vulnerability (CNVD-2016-06186)

Cisco IOS is an operating system developed by Cisco for its network devices. A denial of service vulnerability exists in Cisco IOS, which arises from the program's failure to properly handle invalid NTP packets. A remote attacker could exploit this vulnerability by sending a large number of...

CVE-2016-1478

Cisco IOS 15.53S3, 15.61S2, 15.62S1, and 15.62T1 does not properly dequeue invalid NTP packets, which allows remote attackers to cause a denial of service interface wedge by sending many crafted NTP packets, aka Bug ID CSCva35619...

Cisco IOS and IOS XE Software Crafted Network Time Protocol Packets Denial of Service Vulnerability

A vulnerability in the processing of Network Time Protocol NTP packets by Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause an interface wedge and an eventual denial of service DoS condition on the affected device. The vulnerability is due to insufficient checks ...

ntp: out-of-bounds references on crafted packet

An out-of-bounds access flaw was found in the way ntpd processed certain packets. An authenticated attacker could use a crafted packet to create a peer association with hmode of 7 and larger, which could potentially although highly unlikely cause ntpd to crash...

ntp: crypto-NAK preemptable association denial of service

A denial of service flaw was found in the way NTP handled preemptable client associations. A remote attacker could send several crypto NAK packets to a victim client, each with a spoofed source address of an existing associated peer, preventing that client from synchronizing its time...

ntp: libntp message digest disclosure

A flaw was found in the way NTP's libntp performed message authentication. An attacker able to observe the timing of the comparison function used in packet authentication could potentially use this flaw to recover the message digest...

Moderate: Red Hat Security Advisory: ntp security update

An update for ntp is now available for Red Hat Enterprise Linux 6.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

ntp: ntpd switching to interleaved mode with spoofed packets

It was found that an ntpd client could be forced to change from basic client/server mode to the interleaved symmetric mode. A remote attacker could use a spoofed packet that, when processed by an ntpd client, would cause that client to reject all future legitimate server responses, effectively...

ntp: off-path denial of service on authenticated broadcast mode

It was found that when NTP was configured in broadcast mode, a remote attacker could broadcast packets with bad authentication to all clients. The clients, upon receiving the malformed packets, would break the association with the broadcast server, causing them to become out of sync over a longer...

Debian: Security Advisory (DSA-3629-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-3629-1 : ntp - security update

Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs : - CVE-2015-7974 Matt Street discovered that insufficient key validation allows impersonation attacks between authenticated peers. - CVE-2015-7977 CVE-2015-7978 Stephen Gray discovered that a NULL...

Debian DLA-559-1 : ntp security update

Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs : CVE-2015-7974 Matt Street discovered that insufficient key validation allows impersonation attacks between authenticated peers. CVE-2015-7977 / CVE-2015-7978 Stephen Gray discovered that a NULL...

DSA-3629-1 ntp - security update

Bulletin has no description...

DLA-559-1 ntp - security update

Bulletin has no description...

Meinberg NTP Time Server ELX800/GPS M4x V5.30p - Remote Command Execution / Escalate Privileges

!/usr/bin/python EDB Note: Source https://github.com/securifera/CVE-2016-3962-Exploit EDB Note: More info https://www.securifera.com/blog/2016/07/17/time-to-patch-rce-on-meinberg-ntp-time-server/ 271 - trigger notifications 299 - copy user defined notifications Kernel Version: 2.6.15.1 System...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the ntp-doc package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

The vulnerability of the Wireshark Network Protocol Analyzer software allows a remote attacker to compromise the accessibility of protected information.

The vulnerability exists in the srtpaddaddress function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark, due to an incorrect update of the SRTP dialog data. Exploiting this vulnerability allows malicious actors operating remotely to cause a service failure abrupt termination of ...

The vulnerability of the Wireshark Network Protocol Analyzer software allows a remote attacker to compromise the accessibility of protected information.

The vulnerability exists in the SDP dissector in Wireshark, due to the creation of copies of the hash tables for the media channel. Exploiting this vulnerability allows malicious actors operating remotely to cause a service failure abrupt termination of an application, by sending a specially...

DEBIAN-CVE-2016-4957

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service daemon crash via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547...