CVE-2016-7426

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-7426
NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://nwtime.org/ntp428p9_release/ Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0252.html Third Party Advisory
http://support.ntp.org/bin/view/Main/NtpBug3071 Issue Tracking Mitigation Vendor Advisory
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities Release Notes Vendor Advisory
http://www.securityfocus.com/bid/94451 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1037354 Third Party Advisory VDB Entry
https://bto.bluecoat.com/security-advisory/sa139 Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03706en_us Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc Third Party Advisory
https://usn.ubuntu.com/3707-2/ Third Party Advisory
https://www.kb.cert.org/vuls/id/633847 Third Party Advisory US Government Resource
http://nwtime.org/ntp428p9_release/ Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0252.html Third Party Advisory
http://support.ntp.org/bin/view/Main/NtpBug3071 Issue Tracking Mitigation Vendor Advisory
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities Release Notes Vendor Advisory
http://www.securityfocus.com/bid/94451 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1037354 Third Party Advisory VDB Entry
https://bto.bluecoat.com/security-advisory/sa139 Third Party Advisory
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03706en_us Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc Third Party Advisory
https://usn.ubuntu.com/3707-2/ Third Party Advisory
https://www.kb.cert.org/vuls/id/633847 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p203:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p204:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p205:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p206:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p207:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p208:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p209:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p210:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p211:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p212:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p213:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p214:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p215:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p216:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p217:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p218:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p219:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p220:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p221:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p222:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p223:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p224:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p225:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p226:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p227:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p228:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p229:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p230:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p231_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p232_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p233_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p234_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p235_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p236_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p237_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p238_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p239_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p240_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p241_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p242_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p243_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p244_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p245_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p246_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p247_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p248_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p249_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.5:p250_rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p4:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p5:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p6:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p7:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p8:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:hpe:hpux-ntp:*:*:*:*:*:*:*:*
History

21 Nov 2024, 02:57

Type Values Removed Values Added
References () http://nwtime.org/ntp428p9_release/ - Third Party Advisory () http://nwtime.org/ntp428p9_release/ - Third Party Advisory
References () http://rhn.redhat.com/errata/RHSA-2017-0252.html - Third Party Advisory () http://rhn.redhat.com/errata/RHSA-2017-0252.html - Third Party Advisory
References () http://support.ntp.org/bin/view/Main/NtpBug3071 - Issue Tracking, Mitigation, Vendor Advisory () http://support.ntp.org/bin/view/Main/NtpBug3071 - Issue Tracking, Mitigation, Vendor Advisory
References () http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities - Release Notes, Vendor Advisory () http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities - Release Notes, Vendor Advisory
References () http://www.securityfocus.com/bid/94451 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/94451 - Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1037354 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1037354 - Third Party Advisory, VDB Entry
References () https://bto.bluecoat.com/security-advisory/sa139 - Third Party Advisory () https://bto.bluecoat.com/security-advisory/sa139 - Third Party Advisory
References () https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03706en_us - Third Party Advisory () https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03706en_us - Third Party Advisory
References () https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc - Third Party Advisory () https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc - Third Party Advisory
References () https://usn.ubuntu.com/3707-2/ - Third Party Advisory () https://usn.ubuntu.com/3707-2/ - Third Party Advisory
References () https://www.kb.cert.org/vuls/id/633847 - Third Party Advisory, US Government Resource () https://www.kb.cert.org/vuls/id/633847 - Third Party Advisory, US Government Resource
Information

Published : 2017-01-13 16:59

Updated : 2025-04-20 01:37

NVD link : CVE-2016-7426

Mitre link : CVE-2016-7426

CVE.ORG link : CVE-2016-7426

JSON object : View

Products Affected

hpe

  • hpux-ntp

redhat

  • enterprise_linux_server_tus
  • enterprise_linux_server_eus
  • enterprise_linux_server_aus
  • enterprise_linux_workstation
  • enterprise_linux_desktop
  • enterprise_linux_server

canonical

  • ubuntu_linux

ntp

  • ntp
CWE
CWE-400

Uncontrolled Resource Consumption