Back to Database
Status published
Medium
CVE-2016-1550
An exploitable vulnerability exists in the message authentication functionality of...
Vulnerability Description
An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-1550
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.ubuntu.com/usn/USN-3096-1
- http://www.debian.org/security/2016/dsa-3629
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- https://access.redhat.com/errata/RHSA-2016:1141
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
- https://www.kb.cert.org/vuls/id/718152
- http://rhn.redhat.com/errata/RHSA-2016-1552.html
- http://www.securitytracker.com/id/1035705
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- https://security.netapp.com/advisory/ntap-20171004-0002/
- http://www.talosintelligence.com/reports/TALOS-2016-0084/
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-ntpd
- https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc
- http://www.securityfocus.com/bid/88261
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
- https://security.gentoo.org/glsa/201607-15
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html
- http://packetstormsecurity.com/files/136864/Slackware-Security-Advisory-ntp-Updates.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184669.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html
- https://www.debian.org/security/2016/dsa-3629
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0084
- http://www.securityfocus.com/archive/1/538233/100/0/threaded
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html
- http://www.securityfocus.com/archive/1/archive/1/538233/100/0/threaded
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183647.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
- https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11
- https://www.arista.com/en/support/advisories-notices/security-advisories/1332-security-advisory-19
More from NTP Project
View All →CVE-2016-1551
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the...
Low
3.7
CVE-2016-1549
A malicious authenticated peer can create arbitrarily-many ephemeral associations in...
Medium
6.5
CVE-2016-1548
An attacker can spoof a packet from a legitimate ntpd...
High
7.2
CVE-2016-1547
An off-path attacker can cause a preemptible client association to...
Medium
5.3
Affected Vendor
NTP Project
View all reports →Affected Software
NTP, NTPSec
Vulnerable Versions:
4.2.8p3, 4.2.8p4, a5fb34b9cc89b92a8fef2f459004865c93bb7f92
Timeline
Official Publish:
January 6th, 2017
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.