Last update: April 22, 2024 18:49 UTC (7e7bd5857)
| Resolved | 4.2.8p8 | 02 June 2016 |
|---|---|---|
| References | Bug 3044 | CVE-2016-4954 |
| Affects | ntp-4, up to but not including ntp-4.2.8p8, and ntp-4.3.0 up to, but not including ntp-4.3.93. |
Resolved in 4.2.8p8 |
| CVSS2 Score | LOW 2.6 | AV:N/AC:H/Au:N/C:N/I:N/A:P |
| CVSS3 Score | LOW 3.7 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
An attacker who is able to spoof packets with correct origin timestamps from enough servers before the expected response packets arrive at the target machine can affect some peer variables and, for example, cause a false leap indication to be set.
ntpd instances, and auto-restart ntpd (without -g) if it stops running.This weakness was discovered by Jakub Prokes of Red Hat.