Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 99

Export CSV
CVE-2013-5211

ntp: DoS in monlist feature in ntpd

The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.

CVSS 2.0 · 5.0 Medium EPSS 97.5% KEV · Not listed
Vendors
Ntp Opensuse Oracle
Products
Ntp Opensuse Linux
CVE-2023-26555

ntp: an out-of-bounds write may lead to a DoS

praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ntp
Products
Ntp
CVE-2023-26554

ntp: an out-of-bounds write when adding a '\0' character

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ntp
Products
Ntp
CVE-2023-26553

ntp: an out-of-bounds write when copying the trailing number

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ntp
Products
Ntp
CVE-2023-26552

ntp: an out-of-bounds write when adding a decimal point

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ntp
Products
Ntp
CVE-2023-26551

ntp: an out-of-bounds write in the cp<cpdec while loop

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Ntp
Products
Ntp
CVE-2018-7170

ntp: Ephemeral association time spoofing additional protection

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.

CVSS 3.1 · 5.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Hpe Netapp Ntp and 1 more
Products
Hpux-ntp Hci Solidfire and 7 more
CVE-2018-7184

ntp: Interleaved symmetric mode cannot recover from bad state

ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.

CVSS 3.0 · 7.5 High EPSS 8.6% KEV · Not listed
Vendors
Canonical Netapp Ntp and 2 more
Products
Ubuntu Linux Cloud Backup Steelstore Cloud Integrated Storage and 7 more
CVE-2018-7185

ntp: Unauthenticated packet can reset authenticated interleaved association

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.

CVSS 3.1 · 7.5 High EPSS 9.0% KEV · Not listed
Vendors
Canonical Hpe Netapp and 3 more
Products
Ubuntu Linux Hpux-ntp Hci and 20 more
CVE-2020-15025

ntp: Resource exhaustion via memory leak with CMAC keys

ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.

CVSS 3.1 · 4.4 Medium EPSS 3.1% KEV · Not listed
Vendors
Netapp Ntp Opensuse and 1 more
Products
8300 8300 Firmware 8700 and 24 more
CVE-2019-11331

ntp: Using port 123 for modes where a fixed port number is not required facilitates off-path attacks.

Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks.

CVSS 3.0 · 8.1 High EPSS 2.3% KEV · Not listed
Vendors
Ntp
Products
Ntp
CVE-2018-8956

ntp: ntpd allows remote attackers to prevent a broadcast client from synchronizing its clock

ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker's behalf and send them to the attacker.

CVSS 3.1 · 5.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Ntp
Products
Ntp
CVE-2018-7183

ntp: decodearr() can write beyond its buffer limit

Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.

CVSS 3.0 · 9.8 Critical EPSS 10.2% KEV · Not listed
Vendors
Canonical Freebsd Netapp and 1 more
Products
Ubuntu Linux Freebsd Element Software and 1 more
CVE-2018-7182

ntp: buffer read overrun leads information leak in ctl_getitem()

The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.

CVSS 3.0 · 7.5 High EPSS 28.8% KEV · Not listed
Vendors
Canonical Netapp Ntp
Products
Ubuntu Linux Element Software Ntp
CVE-2018-12327

ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution

Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source.

CVSS 3.0 · 9.8 Critical EPSS 27.5% KEV · Not listed
Vendors
Ntp Redhat
Products
Ntp Enterprise Linux Rhel Eus
CVE-2016-9042

ntp: DoS via origin timestamp check functionality

An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.

CVSS 3.1 · 5.9 Medium EPSS 3.8% KEV · Not listed
Vendors
Freebsd Hpe Ntp and 1 more
Products
Freebsd Hpux-ntp Ntp and 2 more
CVE-2015-7851

ntp: saveconfig directory traversal vulnerability

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

CVSS 3.1 · 6.5 Medium EPSS 3.9% KEV · Not listed
Vendors
Ntp
Products
Ntp