The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
AND |
|
Configuration 5 (hide)
AND |
|
Configuration 6 (hide)
AND |
|
History
No history.
Information
Published : 2016-07-05 01:59
Updated : 2025-04-12 10:46
NVD link : CVE-2016-4954
Mitre link : CVE-2016-4954
CVE.ORG link : CVE-2016-4954
JSON object : View
Products Affected
opensuse
- opensuse
- leap
siemens
- simatic_net_cp_443-1_opc_ua_firmware
- tim_4r-ie_dnp3_firmware
- tim_4r-ie_dnp3
- simatic_net_cp_443-1_opc_ua
- tim_4r-ie
- tim_4r-ie_firmware
oracle
- solaris
suse
- manager
- linux_enterprise_desktop
- manager_proxy
- linux_enterprise_server
- openstack_cloud
ntp
- ntp
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')