CVE-2016-1547: ntp project ntp Improper Input Validation
Vulnerability summary
CVE-2016-1547 is a medium (CVSS 5.3) Improper Input Validation vulnerability in ntp project ntp. EPSS estimates a 5.07% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 6Timeline
- 06-01-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
5.07%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
-0.04 pp
From 5.11% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- ntp< 1:4.2.8p7+dfsg-1
Ntp1 product
- ntp≤ 4.2.8
Ntp project1 product
- ntp4.2.8p3 | 4.2.8p4
Ntpsec project1 product
- ntpseca5fb34b9cc89b92a8fef2f459004865c93bb7f92
Ubuntu1 product
- ntp< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 | < 1:4.2.8p4+dfsg-3ubuntu5.3
5 vendors · 5 products
References
20 links
- www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlX Refsource CONFIRM
- www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlX Refsource CONFIRM
- security.netapp.com/advisory/ntap-20171004-0002/X Refsource CONFIRM
- www.talosintelligence.com/reports/TALOS-2016-0081/X Refsource MISCMitigationTechnical DescriptionThird Party Advisory
Show all 20 references
- cert-portal.siemens.com/productcert/pdf/ssa-497656.pdfX Refsource CONFIRM
us-cert.cisa.gov/ics/advisories/icsa-21-103-11X Refsource CONFIRM- cert-portal.siemens.com/productcert/pdf/ssa-211752.pdfX Refsource CONFIRM