praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver.
Source: MITRE
Max CVSS
6.4
EPSS Score
0.06%
Published
2023-04-11
Updated
2023-06-14
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
Source: MITRE
Max CVSS
5.6
EPSS Score
0.08%
Published
2023-04-11
Updated
2023-04-20
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
Source: MITRE
Max CVSS
5.6
EPSS Score
0.08%
Published
2023-04-11
Updated
2023-04-20
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
Source: MITRE
Max CVSS
5.6
EPSS Score
0.08%
Published
2023-04-11
Updated
2023-04-20
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
Source: MITRE
Max CVSS
5.6
EPSS Score
0.08%
Published
2023-04-11
Updated
2023-04-20
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.
Source: MITRE
Max CVSS
4.9
EPSS Score
0.50%
Published
2020-06-24
Updated
2022-09-02
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
Source: MITRE
Max CVSS
7.4
EPSS Score
5.90%
Published
2020-06-04
Updated
2022-03-29
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.
Source: MITRE
Max CVSS
7.5
EPSS Score
3.26%
Published
2020-04-17
Updated
2022-04-26
Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks.
Source: MITRE
Max CVSS
8.1
EPSS Score
1.40%
Published
2019-04-18
Updated
2020-08-24
NTP through 4.2.8p12 has a NULL Pointer Dereference.
Source: MITRE
Max CVSS
7.5
EPSS Score
0.76%
Published
2019-05-15
Updated
2020-10-07
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source.
Source: MITRE
Max CVSS
9.8
EPSS Score
2.65%
Published
2018-06-20
Updated
2020-08-24
ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker's behalf and send them to the attacker.
Source: MITRE
Max CVSS
5.3
EPSS Score
1.10%
Published
2020-05-06
Updated
2020-07-19
The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.
Source: MITRE
Max CVSS
7.5
EPSS Score
3.22%
Published
2018-03-06
Updated
2020-08-24
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
Source: MITRE
Max CVSS
7.5
EPSS Score
3.99%
Published
2018-03-06
Updated
2020-08-24
Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.
Source: MITRE
Max CVSS
9.8
EPSS Score
71.68%
Published
2018-03-08
Updated
2021-07-20
The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.
Source: MITRE
Max CVSS
7.5
EPSS Score
10.97%
Published
2018-03-06
Updated
2019-10-31
ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.
Source: MITRE
Max CVSS
5.3
EPSS Score
0.14%
Published
2018-03-06
Updated
2020-06-18
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.
Source: MITRE
Max CVSS
6.5
EPSS Score
8.89%
Published
2017-03-27
Updated
2018-04-12
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
Source: MITRE
Max CVSS
6.5
EPSS Score
1.08%
Published
2017-03-27
Updated
2019-01-24
Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.
Source: MITRE
Max CVSS
7.8
EPSS Score
0.04%
Published
2017-03-27
Updated
2019-01-24
Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.
Source: MITRE
Max CVSS
8.8
EPSS Score
0.53%
Published
2017-03-27
Updated
2017-10-24
The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes.
Source: MITRE
Max CVSS
5.5
EPSS Score
0.04%
Published
2017-03-27
Updated
2017-10-24
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.
Source: MITRE
Max CVSS
8.8
EPSS Score
0.49%
Published
2017-03-27
Updated
2021-07-12
NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable.
Source: MITRE
Max CVSS
7.0
EPSS Score
0.04%
Published
2017-03-27
Updated
2017-10-24
Stack-based buffer overflow in the Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via an application path on the command line.
Source: MITRE
Max CVSS
7.8
EPSS Score
0.04%
Published
2017-03-27
Updated
2017-10-24
99 vulnerabilities found
1 2 3 4
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!