CVE-2016-4954

Published: Jul 5, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.

Affected (38)

Products: Ntp: Ntp · Oracle: Solaris · Opensuse: Leap, Opensuse · +2 more

Show all products

Ntp: Ntp · Oracle: Solaris · Opensuse: Leap, Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Server, Manager, Manager Proxy, Openstack Cloud · Siemens: Simatic Net Cp 443 1 Opc Ua Firmware, Tim 4r Ie Firmware, Tim 4r Ie Dnp3 Firmware

1 product

1 product

2 products

5 products

Linux Enterprise Desktop

Linux Enterprise Server

3 products

Simatic Net Cp 443 1 Opc Ua Firmware

Tim 4r Ie Firmware

Tim 4r Ie Dnp3 Firmware

Configuration A

23 vulnerable

Vulnerable Software	Affected Versions
Ntp Ntp	From 4.2.0 to 4.2.8
Ntp Ntp	From 4.3.0 to 4.3.93
Ntp Ntp	Version 4.2.8
Ntp Ntp	Version 4.2.8 p1-beta1
Ntp Ntp	Version 4.2.8 p1-beta2
Ntp Ntp	Version 4.2.8 p1-beta3
Ntp Ntp	Version 4.2.8 p1-beta4
Ntp Ntp	Version 4.2.8 p1-beta5
Ntp Ntp	Version 4.2.8 p1-rc1
Ntp Ntp	Version 4.2.8 p1-rc2
Ntp Ntp	Version 4.2.8 p1
Ntp Ntp	Version 4.2.8 p2-rc1
Ntp Ntp	Version 4.2.8 p2-rc2
Ntp Ntp	Version 4.2.8 p2-rc3
Ntp Ntp	Version 4.2.8 p2
Ntp Ntp	Version 4.2.8 p3-rc1
Ntp Ntp	Version 4.2.8 p3-rc2
Ntp Ntp	Version 4.2.8 p3-rc3
Ntp Ntp	Version 4.2.8 p3
Ntp Ntp	Version 4.2.8 p4
Ntp Ntp	Version 4.2.8 p5
Ntp Ntp	Version 4.2.8 p6
Ntp Ntp	Version 4.2.8 p7

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Solaris	Version 10
Oracle Solaris	Version 11.3

Configuration C

10 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.1
Opensuse Opensuse	Version 13.2
Suse Linux Enterprise Desktop	Version 12 sp1
Suse Linux Enterprise Server	Version 11 sp2
Suse Linux Enterprise Server	Version 11 sp3
Suse Linux Enterprise Server	Version 11 sp4
Suse Linux Enterprise Server	Version 12 sp1
Suse Manager	Version 2.1
Suse Manager Proxy	Version 2.1
Suse Openstack Cloud	Version 5

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Net Cp 443 1 Opc Ua Firmware	All versions

Running on/with	Platform Versions
Siemens Simatic Net Cp 443 1 Opc Ua	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Tim 4r Ie Firmware	All versions

Running on/with	Platform Versions
Siemens Tim 4r Ie	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Tim 4r Ie Dnp3 Firmware	All versions

Running on/with	Platform Versions
Siemens Tim 4r Ie Dnp3	All versions

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (70)

http://bugs.ntp.org/3044

Source: cve@mitre.org

Issue TrackingVendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html

Source: cve@mitre.org

http://packetstormsecurity.com/files/137321/Slackware-Security-Advisory-ntp-Updates.html

Source: cve@mitre.org

http://packetstormsecurity.com/files/137322/FreeBSD-Security-Advisory-FreeBSD-SA-16-24.ntp.html

Source: cve@mitre.org

http://support.ntp.org/bin/view/Main/NtpBug3044

Source: cve@mitre.org

PatchVendor Advisory

http://support.ntp.org/bin/view/Main/SecurityNotice

Source: cve@mitre.org

Vendor Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ntpd

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/321640

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/archive/1/538599/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/538600/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/540683/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/archive/1/538599/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/archive/1/538600/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/archive/1/540683/100/0/threaded

Source: cve@mitre.org

http://www.securitytracker.com/id/1036037

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-3096-1

Source: cve@mitre.org

https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf

Source: cve@mitre.org

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf

Source: cve@mitre.org

Third Party Advisory

https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03757en_us

Source: cve@mitre.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3EYJQHJZ2KTVQ7ICEFHXTLZ36MRASWX/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORAMN3Q7TVJ54MBYF75XCJOE3DP7LYHT/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNWGCQLW2VY72NIUYMJOCAKJKTXHDUK2/

Source: cve@mitre.org

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:24.ntp.asc

Source: cve@mitre.org

Third Party Advisory

https://security.gentoo.org/glsa/201607-15

Source: cve@mitre.org

Third Party Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11

Source: cve@mitre.org

https://www.kb.cert.org/vuls/id/321640

Source: cve@mitre.org

http://bugs.ntp.org/3044