Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 99

Export CSV
CVE-2015-7975

ntp: nextvar() missing length check in ntpq

The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service (application crash).

CVSS 3.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Ntp
Products
Ntp
CVE-2015-7976

ntp: 'ntpq saveconfig' command allows dangerous characters in filenames

The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.

CVSS 3.0 · 4.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Novell Ntp Opensuse and 1 more
Products
Suse Openstack Cloud Ntp Leap and 7 more
CVE-2015-7977

ntp: restriction list NULL pointer dereference

ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.

CVSS 3.1 · 5.9 Medium EPSS 6.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 10 more
CVE-2015-7978

ntp: stack exhaustion in recursive traversal of restriction list

NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.

CVSS 3.0 · 7.5 High EPSS 9.9% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux
CVE-2014-9293

ntp: automatic generation of weak default key in config_auth()

The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

CVSS 2.0 · 7.5 High EPSS 13.0% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux Rhel Eus
CVE-2016-4957

ntp: crypto-NAK DoS (incorrect fix for CVE-2016-1547)

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.

CVSS 3.1 · 7.5 High EPSS 44.9% KEV · Not listed
Vendors
Novell Ntp Opensuse and 2 more
Products
Suse Manager Ntp Leap and 6 more
CVE-2016-4956

ntp: broadcast interleave (incomplete fix for CVE-2016-1548)

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.

CVSS 3.1 · 5.3 Medium EPSS 16.4% KEV · Not listed
Vendors
Novell Ntp Opensuse and 3 more
Products
Suse Manager Ntp Leap and 8 more
CVE-2016-4955

ntp: autokey association reset

ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.

CVSS 3.1 · 5.9 Medium EPSS 8.8% KEV · Not listed
Vendors
Novell Ntp Opensuse and 3 more
Products
Suse Manager Ntp Leap and 8 more
CVE-2016-4954

ntp: partial processing of spoofed packets

The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.

CVSS 3.1 · 7.5 High EPSS 13.3% KEV · Not listed
Vendors
Ntp Opensuse Oracle and 2 more
Products
Ntp Leap Opensuse and 12 more
CVE-2014-9294

ntp: ntp-keygen uses weak random number generator and seed when generating MD5 keys

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

CVSS 2.0 · 7.5 High EPSS 13.0% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux Rhel Eus
CVE-2016-4953

ntp: bad authentication demobilizes ephemeral associations

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.

CVSS 3.1 · 7.5 High EPSS 17.2% KEV · Not listed
Vendors
Ntp Opensuse Oracle and 2 more
Products
Ntp Leap Opensuse and 12 more
CVE-2014-9751

ntp: drop packets with source address ::1

The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address.

CVSS 2.0 · 6.8 Medium EPSS 4.5% KEV · Not listed
Vendors
Apple Debian Linux and 3 more
Products
Macos Debian Linux Linux Kernel and 6 more
CVE-2015-1798

ntp: ntpd accepts unauthenticated packets with symmetric key crypto

The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC.

CVSS 2.0 · 1.8 Low EPSS 2.2% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux
CVE-2015-1799

ntp: authentication doesn't protect symmetric associations against DoS attacks

The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux
CVE-2014-9295

ntp: Multiple buffer overflows via specially-crafted packets

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.

CVSS 2.0 · 7.5 High EPSS 79.1% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux Rhel Eus
CVE-2015-7974

ntp: missing key check allows impersonation between authenticated peers (VU#357792)

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."

CVSS 3.1 · 7.7 High EPSS 5.7% KEV · Not listed
Vendors
Debian Netapp Ntp and 2 more
Products
Debian Linux Clustered Data Ontap Oncommand Balance and 6 more
CVE-2014-9296

ntp: receive() missing return on error

The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets.

CVSS 2.0 · 5.0 Medium EPSS 16.2% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux Rhel Eus
CVE-2014-9750

ntp: vallen in extension fields are not validated

ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.

CVSS 2.0 · 5.8 Medium EPSS 6.1% KEV · Not listed
Vendors
Debian Ntp Oracle and 1 more
Products
Debian Linux Ntp Linux and 4 more