Skip to content
OpenAdvisories
Unscored USN-3096-1 18 CVEs

ntp vulnerabilities

Published Oct 5, 2016 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Aanchal Malhotra discovered that NTP incorrectly handled authenticated
broadcast mode. A remote attacker could use this issue to perform a replay
attack. (CVE-2015-7973)

Matt Street discovered that NTP incorrectly verified peer associations of
symmetric keys. A remote attacker could use this issue to perform an
impersonation attack. (CVE-2015-7974)

Jonathan Gardner discovered that the NTP ntpq utility incorrectly handled
memory. An attacker could possibly use this issue to cause ntpq to crash,
resulting in a denial of service. This issue only affected Ubuntu 16.04
LTS. (CVE-2015-7975)

Jonathan Gardner discovered that the NTP ntpq utility incorrectly handled
dangerous characters in filenames. An attacker could possibly use this
issue to overwrite arbitrary files. (CVE-2015-7976)

Stephen Gray discovered that NTP incorrectly handled large restrict lists.
An attacker could use this issue to cause NTP to crash, resulting in a
denial of service. (CVE-2015-7977, CVE-2015-7978)

Aanchal Malhotra discovered that NTP incorrectly handled authenticated
broadcast mode. A remote attacker could use this issue to cause NTP to
crash, resulting in a denial of service. (CVE-2015-7979)

Jonathan Gardner discovered that NTP incorrectly handled origin timestamp
checks. A remote attacker could use this issue to spoof peer servers.
(CVE-2015-8138)

Jonathan Gardner discovered that the NTP ntpq utility did not properly
handle certain incorrect values. An attacker could possibly use this issue
to cause ntpq to hang, resulting in a denial of service. (CVE-2015-8158)

It was discovered that the NTP cronjob incorrectly cleaned up the
statistics directory. A local attacker could possibly use this to escalate
privileges. (CVE-2016-0727)

Stephen Gray and Matthew Van Gundy discovered that NTP incorrectly
validated crypto-NAKs. A remote attacker could possibly use this issue to
prevent clients from synchronizing. (CVE-2016-1547)

Miroslav Lichvar and Jonathan Gardner discovered that NTP incorrectly
handled switching to interleaved symmetric mode. A remote attacker could
possibly use this issue to prevent clients from synchronizing.
(CVE-2016-1548)

Matthew Van Gundy, Stephen Gray and Loganaden Velvindron discovered that
NTP incorrectly handled message authentication. A remote attacker could
possibly use this issue to recover the message digest key. (CVE-2016-1550)

Yihan Lian discovered that NTP incorrectly handled duplicate IPs on
unconfig directives. An authenticated remote attacker could possibly use
this issue to cause NTP to crash, resulting in a denial of service.
(CVE-2016-2516)

Yihan Lian discovered that NTP incorrectly handled certail peer
associations. A remote attacker could possibly use this issue to cause NTP
to crash, resulting in a denial of service. (CVE-2016-2518)

Jakub Prokes discovered that NTP incorrectly handled certain spoofed
packets. A remote attacker could possibly use this issue to cause a denial
of service. (CVE-2016-4954)

Miroslav Lichvar discovered that NTP incorrectly handled certain packets
when autokey is enabled. A remote attacker could possibly use this issue to
cause a denial of service. (CVE-2016-4955)

Miroslav Lichvar discovered that NTP incorrectly handled certain spoofed
broadcast packets. A remote attacker could possibly use this issue to
cause a denial of service. (CVE-2016-4956)

In the default installation, attackers would be isolated by the NTP
AppArmor profile.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS ntp 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10
Ubuntu · 16.04 LTS 16.04:LTS ntp 1:4.2.8p4+dfsg-3ubuntu5.3

Vulnerabilities 18

  • Unscored —
    CVE-2015-7973

    NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to co…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7974

    NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating pa…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7975

    The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, …

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7976

    The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filte…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7977

    ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer d…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7978

    NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) vi…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-7979 EPSS 12%

    NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server associat…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-8138

    NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a pack…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2015-8158

    The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to caus…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2016-0727 Public exploit

    The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3u…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2016-1547

    An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec…

    NTPsec NTP Project ntpsec NTP Debian Ubuntu
  • Unscored —
    CVE-2016-1548

    An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timest…

    NTPsec NTP Project ntpsec NTP Debian Ubuntu
  • Unscored —
    CVE-2016-1550

    An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5f…

    NTPsec NTP Project ntpsec NTP Debian Ubuntu
  • Unscored —
    CVE-2016-2516

    NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2016-2518 EPSS 15%

    The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2016-4954 EPSS 13%

    The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial …

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2016-4955

    ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-var…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2016-4956 EPSS 16%

    ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and ti…

    ntp ntp Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-7973
  • report
    https://ubuntu.com/security/CVE-2015-7974
  • report
    https://ubuntu.com/security/CVE-2015-7975
  • report
    https://ubuntu.com/security/CVE-2015-7976
  • report
    https://ubuntu.com/security/CVE-2015-7977
  • report
    https://ubuntu.com/security/CVE-2015-7978
  • report
    https://ubuntu.com/security/CVE-2015-7979
  • report
    https://ubuntu.com/security/CVE-2015-8138
  • report
    https://ubuntu.com/security/CVE-2015-8158
  • report
    https://ubuntu.com/security/CVE-2016-0727
  • report
    https://ubuntu.com/security/CVE-2016-1547
  • report
    https://ubuntu.com/security/CVE-2016-1548
  • report
    https://ubuntu.com/security/CVE-2016-1550
  • report
    https://ubuntu.com/security/CVE-2016-2516
  • report
    https://ubuntu.com/security/CVE-2016-2518
  • report
    https://ubuntu.com/security/CVE-2016-4954
  • report
    https://ubuntu.com/security/CVE-2016-4955
  • report
    https://ubuntu.com/security/CVE-2016-4956