CVE-2016-9042: freebsd Improper Input Validation
Vulnerability summary
CVE-2016-9042 is a medium (CVSS 5.9) Improper Input Validation vulnerability in freebsd. EPSS estimates a 3.91% chance of exploitation in the next 30 days, higher than 90.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 5Timeline
- 04-06-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.
CVSS metrics
7 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST3.7LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
3.91%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.91% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (talosintelligence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- ntp< 1:4.2.8p10+dfsg-1
Freebsd1 product
- freebsdEOL10.0 | 11.0
Hpe1 product
- hpux-ntp< c.4.2.8.4.0
Ntp1 product
- ntp4.2.8:p9
Talos1 product
- network time protocolNTP 4.2.8p9
Ubuntu1 product
- ntp< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 | < 1:4.2.8p4+dfsg-3ubuntu5.3
6 vendors · 6 products
References
26 links- security.freebsd.org/advisories/FreeBSD-SA-17:03.ntp.ascVendor AdvisoryX Refsource FREEBSDThird Party Advisory
Show all 26 references
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_usX Refsource CONFIRMThird Party Advisory
- www.talosintelligence.com/vulnerability_reports/TALOS-2016-0260X Refsource MISCExploitMitigationThird Party Advisory
- kc.mcafee.com/corporate/index?page=content&id=SB10201X Refsource CONFIRM
- support.apple.com/kb/HT208144X Refsource CONFIRM
- support.f5.com/csp/article/K39041624X Refsource CONFIRM
- bto.bluecoat.com/security-advisory/sa147X Refsource CONFIRM
us-cert.cisa.gov/ics/advisories/icsa-21-159-11X Refsource MISC