NTP : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2023-26555	787		2023-04-11	2023-04-24	0.0	None	???	???	???	???	???	???
praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver.
2	CVE-2023-26554	787		2023-04-11	2023-04-20	0.0	None	???	???	???	???	???	???
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
3	CVE-2023-26553	787		2023-04-11	2023-04-20	0.0	None	???	???	???	???	???	???
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
4	CVE-2023-26552	787		2023-04-11	2023-04-20	0.0	None	???	???	???	???	???	???
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
5	CVE-2023-26551	787		2023-04-11	2023-04-20	0.0	None	???	???	???	???	???	???
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
6	CVE-2020-15025	401	DoS	2020-06-24	2022-09-02	4.0	None	Remote	Low	???	None	None	Partial
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.
7	CVE-2020-13817	330	DoS	2020-06-04	2022-03-29	5.8	None	Remote	Medium	Not required	None	Partial	Partial
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
8	CVE-2020-11868	346		2020-04-17	2022-04-26	5.0	None	Remote	Low	Not required	None	None	Partial
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.
9	CVE-2019-11331			2019-04-18	2020-08-24	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks.
10	CVE-2019-8936	476		2019-05-15	2020-10-07	5.0	None	Remote	Low	Not required	None	None	Partial
NTP through 4.2.8p12 has a NULL Pointer Dereference.
11	CVE-2018-12327	787	Exec Code Overflow	2018-06-20	2020-08-24	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source.
12	CVE-2018-8956	20		2020-05-06	2020-07-19	5.0	None	Remote	Low	Not required	None	None	Partial
ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker's behalf and send them to the attacker.
13	CVE-2018-7185		DoS	2018-03-06	2020-08-24	5.0	None	Remote	Low	Not required	None	None	Partial
The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.
14	CVE-2018-7184		DoS	2018-03-06	2020-08-24	5.0	None	Remote	Low	Not required	None	None	Partial
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
15	CVE-2018-7183	787	Exec Code Overflow	2018-03-08	2021-07-20	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.
16	CVE-2018-7182	125	DoS	2018-03-06	2019-10-31	5.0	None	Remote	Low	Not required	None	None	Partial
The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.
17	CVE-2018-7170			2018-03-06	2020-06-18	3.5	None	Remote	Medium	???	None	Partial	None
ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.
18	CVE-2017-6464	20	DoS	2017-03-27	2018-04-12	4.0	None	Remote	Low	???	None	None	Partial
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.
19	CVE-2017-6463	20	DoS	2017-03-27	2019-01-24	4.0	None	Remote	Low	???	None	None	Partial
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
20	CVE-2017-6462	119	Overflow	2017-03-27	2019-01-24	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.
21	CVE-2017-6460	119	Overflow	2017-03-27	2017-10-24	6.5	None	Remote	Low	???	Partial	Partial	Partial
Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.
22	CVE-2017-6459	119	Overflow	2017-03-27	2017-10-24	2.1	None	Local	Low	Not required	None	None	Partial
The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes.
23	CVE-2017-6458	119	Overflow	2017-03-27	2021-07-12	6.5	None	Remote	Low	???	Partial	Partial	Partial
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.
24	CVE-2017-6455	94	+Priv	2017-03-27	2017-10-24	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable.
25	CVE-2017-6452	119	Overflow	2017-03-27	2017-10-24	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via an application path on the command line.
26	CVE-2017-6451	787	Exec Code	2017-03-27	2017-10-24	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.
27	CVE-2016-9311	476	DoS	2017-01-13	2019-01-24	7.1	None	Remote	Medium	Not required	None	None	Complete
ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.
28	CVE-2016-9310	400		2017-01-13	2019-01-24	6.4	None	Remote	Low	Not required	Partial	None	Partial
The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet.
29	CVE-2016-9042	20	DoS	2018-06-04	2022-04-19	4.3	None	Remote	Medium	Not required	None	None	Partial
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.
30	CVE-2016-7434	20	DoS	2017-01-13	2020-06-18	4.3	None	Remote	Medium	Not required	None	None	Partial
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.
31	CVE-2016-7433	682		2017-01-13	2021-07-16	5.0	None	Remote	Low	Not required	None	None	Partial
NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance that did not include the peer dispersion."
32	CVE-2016-7431	20	Bypass	2017-01-13	2021-07-12	5.0	None	Remote	Low	Not required	None	Partial	None
NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero. NOTE: this vulnerability exists because of a CVE-2015-8138 regression.
33	CVE-2016-7429	18	DoS	2017-01-13	2018-01-05	4.3	None	Remote	Medium	Not required	None	None	Partial
NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of service (prevent communication with a source) by sending a response for a source to an interface the source does not use.
34	CVE-2016-7428	400	DoS	2017-01-13	2019-01-24	3.3	None	Local Network	Low	Not required	None	None	Partial
ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast packet.
35	CVE-2016-7427	400	DoS	2017-01-13	2019-01-24	3.3	None	Local Network	Low	Not required	None	None	Partial
The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via a crafted broadcast mode packet.
36	CVE-2016-7426	400	DoS	2017-01-13	2020-06-18	4.3	None	Remote	Medium	Not required	None	None	Partial
NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.
37	CVE-2016-4957	476	DoS	2016-07-05	2020-06-18	5.0	None	Remote	Low	Not required	None	None	Partial
ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.
38	CVE-2016-4956		DoS	2016-07-05	2021-07-16	5.0	None	Remote	Low	Not required	None	None	Partial
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.
39	CVE-2016-4955	362	DoS	2016-07-05	2021-07-16	4.3	None	Remote	Medium	Not required	None	None	Partial
ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.
40	CVE-2016-4954	362	DoS	2016-07-05	2021-07-16	5.0	None	Remote	Low	Not required	None	None	Partial
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.
41	CVE-2016-4953	287	DoS	2016-07-05	2021-07-16	5.0	None	Remote	Low	Not required	None	None	Partial
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.
42	CVE-2016-2519	119	DoS Overflow	2017-01-30	2017-11-21	4.9	None	Remote	High	???	None	None	Complete
ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data value, which triggers the ctl_getitem function to return a NULL value.
43	CVE-2016-2518	125		2017-01-30	2021-06-10	5.0	None	Remote	Low	Not required	None	None	Partial
The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.
44	CVE-2016-2517	20	DoS	2017-01-30	2017-11-21	4.9	None	Remote	High	???	None	None	Complete
NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression.
45	CVE-2016-2516	20	DoS	2017-01-30	2017-11-21	7.1	None	Remote	Medium	Not required	None	None	Complete
NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times in an unconfig directive.
46	CVE-2016-1551	254		2017-01-27	2017-11-21	2.6	None	Remote	High	Not required	None	Partial	None
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock's peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.
47	CVE-2016-1550	200	+Info	2017-01-06	2021-11-17	5.0	None	Remote	Low	Not required	Partial	None	None
An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key.
48	CVE-2016-1549	19		2017-01-06	2018-03-28	4.0	None	Remote	Low	???	None	Partial	None
A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock.
49	CVE-2016-1548	19		2017-01-06	2021-11-17	6.4	None	Remote	Low	Not required	None	Partial	Partial
An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.
50	CVE-2016-1547	20		2017-01-06	2021-11-17	5.0	None	Remote	Low	Not required	None	None	Partial
An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.

Total number of vulnerabilities : 97 Page : 1 (This Page)2