CVE-2016-9042
Detail
Modified
This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.
Description
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0 Severity and Vector Strings:
Vector:
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected] .
URL
Source(s)
Tag(s)
http://packetstormsecurity.com/files/142101/FreeBSD-Security-Advisory-FreeBSD-SA-17-03.ntp.html
CVE, Talos
http://packetstormsecurity.com/files/142284/Slackware-Security-Advisory-ntp-Updates.html
CVE, Talos
http://seclists.org/fulldisclosure/2017/Nov/7
CVE, Talos
http://seclists.org/fulldisclosure/2017/Sep/62
CVE, Talos
http://www.securityfocus.com/archive/1/540403/100/0/threaded
CVE, Talos
http://www.securityfocus.com/archive/1/archive/1/540403/100/0/threaded
CVE, Talos
http://www.securityfocus.com/archive/1/archive/1/540464/100/0/threaded
CVE, Talos
http://www.securityfocus.com/bid/97046
CVE, Talos
Permissions Required
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038123
CVE, Talos
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039427
CVE, Talos
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-3349-1
CVE, Talos
https://bto.bluecoat.com/security-advisory/sa147
CVE, Talos
https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
CVE, Talos
Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10201
CVE, Talos
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KVLFA3J43QFIP4I7HE7KQ5FXSMJEKC6/
CVE, Talos
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:03.ntp.asc
CVE, Talos
Third Party Advisory
https://support.apple.com/kb/HT208144
CVE, Talos
https://support.f5.com/csp/article/K39041624
CVE, Talos
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
CVE, Talos
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11
CVE, Talos
https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0260
CVE, Talos
Exploit
Mitigation
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-20
Improper Input Validation
NIST
Change History
10 change records found show changes
CVE Modified by CVE 11/20/2024 10:00:29 PM
Action
Type
Old Value
New Value
Added
Reference
http://packetstormsecurity.com/files/142101/FreeBSD-Security-Advisory-FreeBSD-SA-17-03.ntp.html
Added
Reference
http://packetstormsecurity.com/files/142284/Slackware-Security-Advisory-ntp-Updates.html
Added
Reference
http://seclists.org/fulldisclosure/2017/Nov/7
Added
Reference
http://seclists.org/fulldisclosure/2017/Sep/62
Added
Reference
http://www.securityfocus.com/archive/1/540403/100/0/threaded
Added
Reference
http://www.securityfocus.com/archive/1/archive/1/540403/100/0/threaded
Added
Reference
http://www.securityfocus.com/archive/1/archive/1/540464/100/0/threaded
Added
Reference
http://www.securityfocus.com/bid/97046
Added
Reference
http://www.securitytracker.com/id/1038123
Added
Reference
http://www.securitytracker.com/id/1039427
Added
Reference
http://www.ubuntu.com/usn/USN-3349-1
Added
Reference
https://bto.bluecoat.com/security-advisory/sa147
Added
Reference
https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
Added
Reference
https://kc.mcafee.com/corporate/index?page=content&id=SB10201
Added
Reference
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KVLFA3J43QFIP4I7HE7KQ5FXSMJEKC6/
Added
Reference
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:03.ntp.asc
Added
Reference
https://support.apple.com/kb/HT208144
Added
Reference
https://support.f5.com/csp/article/K39041624
Added
Reference
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
Added
Reference
https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11
Added
Reference
https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0260
CVE Modified by Talos 5/14/2024 12:08:17 AM
Action
Type
Old Value
New Value
CVE Modified by Talos 11/06/2023 9:36:42 PM
Action
Type
Old Value
New Value
Added
Reference
Talos https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KVLFA3J43QFIP4I7HE7KQ5FXSMJEKC6/ [No types assigned]
Removed
Reference
Talos https://lists.fedoraproject.org/archives/list/[email protected] /message/7KVLFA3J43QFIP4I7HE7KQ5FXSMJEKC6/
CVE Modified by Talos 4/19/2022 4:15:12 PM
Action
Type
Old Value
New Value
Added
CVSS V3
Talos AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE Modified by Talos 7/12/2021 1:15:08 PM
Action
Type
Old Value
New Value
Added
Reference
http://packetstormsecurity.com/files/142101/FreeBSD-Security-Advisory-FreeBSD-SA-17-03.ntp.html [No Types Assigned]
Added
Reference
http://packetstormsecurity.com/files/142284/Slackware-Security-Advisory-ntp-Updates.html [No Types Assigned]
Added
Reference
http://seclists.org/fulldisclosure/2017/Nov/7 [No Types Assigned]
Added
Reference
http://seclists.org/fulldisclosure/2017/Sep/62 [No Types Assigned]
Added
Reference
http://www.securityfocus.com/archive/1/540403/100/0/threaded [No Types Assigned]
Added
Reference
http://www.securityfocus.com/archive/1/archive/1/540403/100/0/threaded [No Types Assigned]
Added
Reference
http://www.securityfocus.com/archive/1/archive/1/540464/100/0/threaded [No Types Assigned]
Added
Reference
http://www.ubuntu.com/usn/USN-3349-1 [No Types Assigned]
Added
Reference
https://bto.bluecoat.com/security-advisory/sa147 [No Types Assigned]
Added
Reference
https://kc.mcafee.com/corporate/index?page=content&id=SB10201 [No Types Assigned]
Added
Reference
https://lists.fedoraproject.org/archives/list/[email protected] /message/7KVLFA3J43QFIP4I7HE7KQ5FXSMJEKC6/ [No Types Assigned]
Added
Reference
https://support.apple.com/kb/HT208144 [No Types Assigned]
Added
Reference
https://support.f5.com/csp/article/K39041624 [No Types Assigned]
Added
Reference
https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11 [No Types Assigned]
Modified Analysis by NIST 6/08/2021 3:48:40 PM
Action
Type
Old Value
New Value
Added
CVSS V3.1
NIST AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Removed
CVSS V3
NIST AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Added
CPE Configuration
AND
OR
*cpe:2.3:o:siemens:simatic_net_cp_443-1_opc_ua_firmware:*:*:*:*:*:*:*:*
OR
cpe:2.3:h:siemens:simatic_net_cp_443-1_opc_ua:-:*:*:*:*:*:*:*
Added
CPE Configuration
OR
*cpe:2.3:a:hpe:hpux-ntp:*:*:*:*:*:*:*:* versions up to (excluding) c.4.2.8.4.0
Changed
Reference Type
https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf No Types Assigned
https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf Third Party Advisory
Changed
Reference Type
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us No Types Assigned
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us Third Party Advisory
CVE Modified by Talos 6/08/2021 8:15:09 AM
Action
Type
Old Value
New Value
Added
Reference
https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf [No Types Assigned]
CVE Modified by Talos 10/31/2019 3:15:11 PM
Action
Type
Old Value
New Value
Added
Reference
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us [No Types Assigned]
Initial Analysis by NIST 8/02/2018 9:41:47 AM
Action
Type
Old Value
New Value
Added
CVSS V3
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Added
CVSS V2
(AV:N/AC:M/Au:N/C:N/I:N/A:P)
Added
CWE
CWE-20
Added
CPE Configuration
OR
*cpe:2.3:a:ntp:ntp:4.2.8:p9:*:*:*:*:*:*
Added
CPE Configuration
OR
*cpe:2.3:o:freebsd:freebsd:10.0:*:*:*:*:*:*:*
*cpe:2.3:o:freebsd:freebsd:11.0:*:*:*:*:*:*:*
Changed
Reference Type
http://www.securityfocus.com/bid/97046 No Types Assigned
http://www.securityfocus.com/bid/97046 Permissions Required, Third Party Advisory, VDB Entry
Changed
Reference Type
http://www.securitytracker.com/id/1038123 No Types Assigned
http://www.securitytracker.com/id/1038123 Third Party Advisory, VDB Entry
Changed
Reference Type
http://www.securitytracker.com/id/1039427 No Types Assigned
http://www.securitytracker.com/id/1039427 Third Party Advisory, VDB Entry
Changed
Reference Type
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:03.ntp.asc No Types Assigned
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:03.ntp.asc Third Party Advisory
Changed
Reference Type
https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0260 No Types Assigned
https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0260 Exploit, Mitigation, Third Party Advisory
CVE Modified by Talos 6/05/2018 9:29:01 PM
Action
Type
Old Value
New Value
Added
Reference
http://www.securityfocus.com/bid/97046 [No Types Assigned]
Added
Reference
http://www.securitytracker.com/id/1038123 [No Types Assigned]
Added
Reference
http://www.securitytracker.com/id/1039427 [No Types Assigned]
Added
Reference
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:03.ntp.asc [No Types Assigned]
Quick Info
CVE Dictionary Entry: CVE-2016-9042 NVD
Published Date: 06/04/2018 NVD
Last Modified: 11/20/2024
Source: Talos