CVE-2016-7434: hpe hpux-ntp Improper Input Validation

CVSS: 7.5v3.1HighModified

AliasesUBUNTU-CVE-2016-7434DEBIAN-CVE-2016-7434

Published 13-01-2017Last modified 06-08-2024

Vulnerability summary

CVE-2016-7434 is a high (CVSS 7.5) Improper Input Validation vulnerability in hpe hpux-ntp. EPSS estimates a 53.09% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

51/100

0100

High · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

53.09%

0%100%

Critical · +0.15 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 6 · Related 6

OPENSUSE-SU-2024:10181-1 SUSE-SU-2016:3193-1 SUSE-SU-2016:3195-1 SUSE-SU-2016:3196-1 SUSE-SU-2017:0255-1 USN-3349-1

Timeline

13-01-2017
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.

CVSS metrics

5 scores · 3 sources · 3 versions

v3.17.5v3.07.5v2.04.3

EPSS trend

Probability

53.09%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

+0.15 pp

From 52.94% on 18-09-2026

18-09-202618-10-2026

EPSS score

53.09%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databasedoslinuxVerified
NTP 4.2.8p8 - Denial of Service
Maturity: poc

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Debian1 product

ntp< 1:4.2.8p9+dfsg-1

Hpe1 product

hpux-ntp≥ b.11.31, < c.4.2.8.2.0

Ntp1 product

ntp≥ 4.3.0, < 4.3.94 | 4.2.7:p100 | 4.2.7:p101 | 4.2.7:p102 | 4.2.7:p103 | 4.2.7:p104 | 4.2.7:p105 | 4.2.7:p106 | 4.2.7:p107 | 4.2.7:p108 | 4.2.7:p109 | 4.2.7:p110 | 4.2.7:p111 | 4.2.7:p112 | 4.2.7:p113 | 4.2.7:p114 | 4.2.7:p115 | 4.2.7:p116 | 4.2.7:p117 | 4.2.7:p118 | 4.2.7:p119 | 4.2.7:p120 | 4.2.7:p121 | 4.2.7:p122 | 4.2.7:p123 | 4.2.7:p124 | 4.2.7:p125 | 4.2.7:p126 | 4.2.7:p127 | 4.2.7:p128 | 4.2.7:p129 | 4.2.7:p130 | 4.2.7:p131 | 4.2.7:p132 | 4.2.7:p133 | 4.2.7:p134 | 4.2.7:p135 | 4.2.7:p136 | 4.2.7:p137 | 4.2.7:p138 | 4.2.7:p139 | 4.2.7:p140 | 4.2.7:p141 | 4.2.7:p142 | 4.2.7:p143 | 4.2.7:p144 | 4.2.7:p145 | 4.2.7:p146 | 4.2.7:p147 | 4.2.7:p148 | 4.2.7:p149 | 4.2.7:p150 | 4.2.7:p151 | 4.2.7:p152 | 4.2.7:p153 | 4.2.7:p154 | 4.2.7:p155 | 4.2.7:p156 | 4.2.7:p157 | 4.2.7:p158 | 4.2.7:p159 | 4.2.7:p160 | 4.2.7:p161 | 4.2.7:p162 | 4.2.7:p163 | 4.2.7:p164 | 4.2.7:p165 | 4.2.7:p166 | 4.2.7:p170 | 4.2.7:p171 | 4.2.7:p172 | 4.2.7:p173 | 4.2.7:p174 | 4.2.7:p175 | 4.2.7:p176 | 4.2.7:p177 | 4.2.7:p178 | 4.2.7:p179 | 4.2.7:p180 | 4.2.7:p181 | 4.2.7:p182 | 4.2.7:p183 | 4.2.7:p184 | 4.2.7:p185 | 4.2.7:p186 | 4.2.7:p187 | 4.2.7:p188 | 4.2.7:p189 | 4.2.7:p190 | 4.2.7:p191 | 4.2.7:p192 | 4.2.7:p193 | 4.2.7:p194 | 4.2.7:p195 | 4.2.7:p196 | 4.2.7:p197 | 4.2.7:p198 | 4.2.7:p199 | 4.2.7:p200 | 4.2.7:p201 | 4.2.7:p202 | 4.2.7:p203 | 4.2.7:p204 | 4.2.7:p205 | 4.2.7:p206 | 4.2.7:p207 | 4.2.7:p208 | 4.2.7:p209 | 4.2.7:p210 | 4.2.7:p211 | 4.2.7:p212 | 4.2.7:p213 | 4.2.7:p214 | 4.2.7:p215 | 4.2.7:p216 | 4.2.7:p217 | 4.2.7:p218 | 4.2.7:p219 | 4.2.7:p22 | 4.2.7:p220 | 4.2.7:p221 | 4.2.7:p222 | 4.2.7:p223 | 4.2.7:p224 | 4.2.7:p225 | 4.2.7:p226 | 4.2.7:p227 | 4.2.7:p228 | 4.2.7:p229 | 4.2.7:p23 | 4.2.7:p230 | 4.2.7:p231 | 4.2.7:p232 | 4.2.7:p233 | 4.2.7:p234 | 4.2.7:p235 | 4.2.7:p236 | 4.2.7:p237 | 4.2.7:p238 | 4.2.7:p239 | 4.2.7:p24 | 4.2.7:p240 | 4.2.7:p241 | 4.2.7:p242 | 4.2.7:p243 | 4.2.7:p244 | 4.2.7:p245 | 4.2.7:p246 | 4.2.7:p247 | 4.2.7:p248 | 4.2.7:p249 | 4.2.7:p25 | 4.2.7:p250 | 4.2.7:p251 | 4.2.7:p252 | 4.2.7:p253 | 4.2.7:p254 | 4.2.7:p255 | 4.2.7:p256 | 4.2.7:p257 | 4.2.7:p258 | 4.2.7:p259 | 4.2.7:p26 | 4.2.7:p260 | 4.2.7:p261 | 4.2.7:p262 | 4.2.7:p263 | 4.2.7:p264 | 4.2.7:p265 | 4.2.7:p266 | 4.2.7:p267 | 4.2.7:p268 | 4.2.7:p269 | 4.2.7:p27 | 4.2.7:p270 | 4.2.7:p271 | 4.2.7:p272 | 4.2.7:p273 | 4.2.7:p274 | 4.2.7:p275 | 4.2.7:p276 | 4.2.7:p277 | 4.2.7:p278 | 4.2.7:p279 | 4.2.7:p28 | 4.2.7:p280 | 4.2.7:p281 | 4.2.7:p282 | 4.2.7:p283 | 4.2.7:p284 | 4.2.7:p285 | 4.2.7:p286 | 4.2.7:p287 | 4.2.7:p288 | 4.2.7:p289 | 4.2.7:p29 | 4.2.7:p290 | 4.2.7:p291 | 4.2.7:p292 | 4.2.7:p293 | 4.2.7:p294 | 4.2.7:p295 | 4.2.7:p296 | 4.2.7:p297 | 4.2.7:p298 | 4.2.7:p299 | 4.2.7:p30 | 4.2.7:p300 | 4.2.7:p301 | 4.2.7:p302 | 4.2.7:p303 | 4.2.7:p304 | 4.2.7:p305 | 4.2.7:p306 | 4.2.7:p307 | 4.2.7:p308 | 4.2.7:p309 | 4.2.7:p31 | 4.2.7:p310 | 4.2.7:p311 | 4.2.7:p312 | 4.2.7:p313 | 4.2.7:p314 | 4.2.7:p315 | 4.2.7:p316 | 4.2.7:p317 | 4.2.7:p318 | 4.2.7:p319 | 4.2.7:p32 | 4.2.7:p320 | 4.2.7:p321 | 4.2.7:p322 | 4.2.7:p323 | 4.2.7:p324 | 4.2.7:p325 | 4.2.7:p326 | 4.2.7:p327 | 4.2.7:p328 | 4.2.7:p329 | 4.2.7:p33 | 4.2.7:p330 | 4.2.7:p331 | 4.2.7:p332 | 4.2.7:p333 | 4.2.7:p334 | 4.2.7:p335 | 4.2.7:p336 | 4.2.7:p337 | 4.2.7:p338 | 4.2.7:p339 | 4.2.7:p34 | 4.2.7:p340 | 4.2.7:p341 | 4.2.7:p342 | 4.2.7:p343 | 4.2.7:p344 | 4.2.7:p345 | 4.2.7:p346 | 4.2.7:p347 | 4.2.7:p348 | 4.2.7:p349 | 4.2.7:p35 | 4.2.7:p350 | 4.2.7:p351 | 4.2.7:p352 | 4.2.7:p353 | 4.2.7:p354 | 4.2.7:p355 | 4.2.7:p356 | 4.2.7:p357 | 4.2.7:p358 | 4.2.7:p359 | 4.2.7:p36 | 4.2.7:p360 | 4.2.7:p361 | 4.2.7:p362 | 4.2.7:p363 | 4.2.7:p364 | 4.2.7:p365 | 4.2.7:p366 | 4.2.7:p367 | 4.2.7:p368 | 4.2.7:p369 | 4.2.7:p37 | 4.2.7:p370 | 4.2.7:p371 | 4.2.7:p372 | 4.2.7:p373 | 4.2.7:p374 | 4.2.7:p375 | 4.2.7:p376 | 4.2.7:p377 | 4.2.7:p378 | 4.2.7:p379 | 4.2.7:p38 | 4.2.7:p380 | 4.2.7:p381 | 4.2.7:p382 | 4.2.7:p383 | 4.2.7:p384 | 4.2.7:p385 | 4.2.7:p386 | 4.2.7:p387 | 4.2.7:p388 | 4.2.7:p389 | 4.2.7:p39 | 4.2.7:p390 | 4.2.7:p391 | 4.2.7:p392 | 4.2.7:p393 | 4.2.7:p394 | 4.2.7:p395 | 4.2.7:p396 | 4.2.7:p397 | 4.2.7:p398 | 4.2.7:p399 | 4.2.7:p4 | 4.2.7:p40 | 4.2.7:p400 | 4.2.7:p401 | 4.2.7:p402 | 4.2.7:p403 | 4.2.7:p404 | 4.2.7:p405 | 4.2.7:p406 | 4.2.7:p407 | 4.2.7:p408 | 4.2.7:p409 | 4.2.7:p41 | 4.2.7:p410 | 4.2.7:p411 | 4.2.7:p412 | 4.2.7:p413 | 4.2.7:p414 | 4.2.7:p415 | 4.2.7:p416 | 4.2.7:p417 | 4.2.7:p418 | 4.2.7:p419 | 4.2.7:p42 | 4.2.7:p420 | 4.2.7:p421 | 4.2.7:p422 | 4.2.7:p423 | 4.2.7:p424 | 4.2.7:p425 | 4.2.7:p426 | 4.2.7:p427 | 4.2.7:p428 | 4.2.7:p429 | 4.2.7:p43 | 4.2.7:p430 | 4.2.7:p431 | 4.2.7:p432 | 4.2.7:p433 | 4.2.7:p434 | 4.2.7:p435 | 4.2.7:p436 | 4.2.7:p437 | 4.2.7:p438 | 4.2.7:p439 | 4.2.7:p44 | 4.2.7:p440 | 4.2.7:p441 | 4.2.7:p442 | 4.2.7:p443 | 4.2.7:p444 | 4.2.7:p445 | 4.2.7:p446 | 4.2.7:p447 | 4.2.7:p448 | 4.2.7:p449 | 4.2.7:p45 | 4.2.7:p450 | 4.2.7:p451 | 4.2.7:p452 | 4.2.7:p453 | 4.2.7:p454 | 4.2.7:p455 | 4.2.7:p456 | 4.2.7:p457 | 4.2.7:p458 | 4.2.7:p459 | 4.2.7:p46 | 4.2.7:p460 | 4.2.7:p461 | 4.2.7:p462 | 4.2.7:p463 | 4.2.7:p464 | 4.2.7:p465 | 4.2.7:p466 | 4.2.7:p467 | 4.2.7:p468 | 4.2.7:p469 | 4.2.7:p47 | 4.2.7:p470 | 4.2.7:p471 | 4.2.7:p472 | 4.2.7:p473 | 4.2.7:p474 | 4.2.7:p475 | 4.2.7:p476 | 4.2.7:p477 | 4.2.7:p478 | 4.2.7:p479 | 4.2.7:p48 | 4.2.7:p480 | 4.2.7:p481 | 4.2.7:p482 | 4.2.7:p483 | 4.2.7:p484_rc1 | 4.2.7:p485_rc1 | 4.2.7:p486_rc1 | 4.2.7:p49 | 4.2.7:p5 | 4.2.7:p50 | 4.2.7:p51 | 4.2.7:p52 | 4.2.7:p53 | 4.2.7:p54 | 4.2.7:p55 | 4.2.7:p56 | 4.2.7:p57 | 4.2.7:p58 | 4.2.7:p59 | 4.2.7:p6 | 4.2.7:p60 | 4.2.7:p61 | 4.2.7:p62 | 4.2.7:p63 | 4.2.7:p64 | 4.2.7:p65 | 4.2.7:p66 | 4.2.7:p67 | 4.2.7:p68 | 4.2.7:p69 | 4.2.7:p7 | 4.2.7:p70 | 4.2.7:p71 | 4.2.7:p72 | 4.2.7:p73 | 4.2.7:p74 | 4.2.7:p75 | 4.2.7:p76 | 4.2.7:p77 | 4.2.7:p78 | 4.2.7:p79 | 4.2.7:p8 | 4.2.7:p80 | 4.2.7:p81 | 4.2.7:p82 | 4.2.7:p83 | 4.2.7:p84 | 4.2.7:p85 | 4.2.7:p86 | 4.2.7:p87 | 4.2.7:p88 | 4.2.7:p89 | 4.2.7:p9 | 4.2.7:p90 | 4.2.7:p91 | 4.2.7:p92 | 4.2.7:p93 | 4.2.7:p94 | 4.2.7:p95 | 4.2.7:p96 | 4.2.7:p97 | 4.2.7:p98 | 4.2.7:p99 | 4.2.8 | 4.2.8:p1 | 4.2.8:p1-beta1 | 4.2.8:p1-beta2 | 4.2.8:p1-beta3 | 4.2.8:p1-beta4 | 4.2.8:p1-beta5 | 4.2.8:p1-rc1 | 4.2.8:p1-rc2 | 4.2.8:p2 | 4.2.8:p2-rc1 | 4.2.8:p2-rc2 | 4.2.8:p2-rc3 | 4.2.8:p3 | 4.2.8:p3-rc1 | 4.2.8:p3-rc2 | 4.2.8:p3-rc3 | 4.2.8:p4 | 4.2.8:p5 | 4.2.8:p6 | 4.2.8:p7 | 4.2.8:p8

Ubuntu1 product

ntp< 1:4.2.8p4+dfsg-3ubuntu5.5

4 vendors · 4 products

References

14 links

h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03706en_usX Refsource CONFIRMThird Party Advisory
www.securityfocus.com/bid/94448VDB EntryX Refsource BIDThird Party Advisory
support.ntp.org/bin/view/Main/NtpBug3082X Refsource CONFIRMIssue TrackingMitigationVendor Advisory
www.exploit-db.com/exploits/40806/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
support.ntp.org/bin/view/Main/SecurityNoticeX Refsource CONFIRMRelease NotesVendor Advisory
nwtime.org/ntp428p9_release/X Refsource CONFIRMThird Party Advisory
www.kb.cert.org/vuls/id/633847Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.securitytracker.com/id/1037354VDB EntryX Refsource SECTRACKThird Party Advisory
bto.bluecoat.com/security-advisory/sa139X Refsource CONFIRMThird Party Advisory
security.freebsd.org/advisories/FreeBSD-SA-16:39.ntp.ascVendor AdvisoryX Refsource FREEBSDThird Party Advisory

Show all 14 references

ubuntu.com/security/CVE-2016-7434REPORT
ubuntu.com/security/notices/USN-3349-1Advisory
www.cve.org/CVERecord?id=CVE-2016-7434REPORT
security-tracker.debian.org/tracker/CVE-2016-7434Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities