CVE-2016-2518

EPSS 1.47%
Published 30.01.2017 21:59:01
Last modified 20.04.2025 01:37:25
Source cve@mitre.org
Teams watchlist Login
Open Login

The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.

Affected products Warnungen 0 Metrics 3 CWE 1 References 36

Data is provided by the National Vulnerability Database (NVD)

Ntp ≫ Ntp Version < 4.2.8

Ntp ≫ Ntp Version >= 4.3.0 < 4.3.92

Ntp ≫ Ntp Version4.2.8 Update-

Ntp ≫ Ntp Version4.2.8 Updatep1

Ntp ≫ Ntp Version4.2.8 Updatep1-beta1

Ntp ≫ Ntp Version4.2.8 Updatep1-beta2

Ntp ≫ Ntp Version4.2.8 Updatep1-beta3

Ntp ≫ Ntp Version4.2.8 Updatep1-beta4

Ntp ≫ Ntp Version4.2.8 Updatep1-beta5

Ntp ≫ Ntp Version4.2.8 Updatep1-rc1

Ntp ≫ Ntp Version4.2.8 Updatep1-rc2

Ntp ≫ Ntp Version4.2.8 Updatep2

Ntp ≫ Ntp Version4.2.8 Updatep2-rc1

Ntp ≫ Ntp Version4.2.8 Updatep2-rc2

Ntp ≫ Ntp Version4.2.8 Updatep2-rc3

Ntp ≫ Ntp Version4.2.8 Updatep3

Ntp ≫ Ntp Version4.2.8 Updatep3-rc1

Ntp ≫ Ntp Version4.2.8 Updatep3-rc2

Ntp ≫ Ntp Version4.2.8 Updatep3-rc3

Ntp ≫ Ntp Version4.2.8 Updatep4

Ntp ≫ Ntp Version4.2.8 Updatep5

Ntp ≫ Ntp Version4.2.8 Updatep6

Ntp ≫ Ntp Version4.2.8 Updatep7

Ntp ≫ Ntp Version4.2.8 Updatep8

Debian ≫ Debian Linux Version8.0

Debian ≫ Debian Linux Version9.0

Debian ≫ Debian Linux Version10.0

Netapp ≫ Clustered Data Ontap Version-

Netapp ≫ Data Ontap Version- SwPlatform7-mode

Netapp ≫ Oncommand Balance Version-

Netapp ≫ Oncommand Performance Manager Version-

Netapp ≫ Oncommand Unified Manager For Clustered Data Ontap Version-

Oracle ≫ Communications User Data Repository Version10.0.0

Oracle ≫ Communications User Data Repository Version10.0.1

Oracle ≫ Communications User Data Repository Version12.0.0

Oracle ≫ Linux Version6 Update-

Oracle ≫ Linux Version7 Update-

Redhat ≫ Enterprise Linux Desktop Version7.0

Redhat ≫ Enterprise Linux Server Version6.0

Redhat ≫ Enterprise Linux Server Version7.0

Redhat ≫ Enterprise Linux Server Aus Version7.2

Redhat ≫ Enterprise Linux Server Aus Version7.4

Redhat ≫ Enterprise Linux Server Aus Version7.6

Redhat ≫ Enterprise Linux Server Eus Version7.2

Redhat ≫ Enterprise Linux Server Eus Version7.3

Redhat ≫ Enterprise Linux Server Eus Version7.4

Redhat ≫ Enterprise Linux Server Eus Version7.5

Redhat ≫ Enterprise Linux Server Eus Version7.6

Redhat ≫ Enterprise Linux Server Eus Version7.7

Redhat ≫ Enterprise Linux Server Tus Version7.2

Redhat ≫ Enterprise Linux Server Tus Version7.3

Redhat ≫ Enterprise Linux Server Tus Version7.6

Redhat ≫ Enterprise Linux Server Tus Version7.7

Redhat ≫ Enterprise Linux Workstation Version6.0

Freebsd ≫ Freebsd Version9.3 Update-

Freebsd ≫ Freebsd Version9.3 Updatep1

Freebsd ≫ Freebsd Version9.3 Updatep10

Freebsd ≫ Freebsd Version9.3 Updatep12

Freebsd ≫ Freebsd Version9.3 Updatep13

Freebsd ≫ Freebsd Version9.3 Updatep16

Freebsd ≫ Freebsd Version9.3 Updatep19

Freebsd ≫ Freebsd Version9.3 Updatep2

Freebsd ≫ Freebsd Version9.3 Updatep20

Freebsd ≫ Freebsd Version9.3 Updatep21

Freebsd ≫ Freebsd Version9.3 Updatep22

Freebsd ≫ Freebsd Version9.3 Updatep23

Freebsd ≫ Freebsd Version9.3 Updatep24

Freebsd ≫ Freebsd Version9.3 Updatep25

Freebsd ≫ Freebsd Version9.3 Updatep28

Freebsd ≫ Freebsd Version9.3 Updatep3

Freebsd ≫ Freebsd Version9.3 Updatep30

Freebsd ≫ Freebsd Version9.3 Updatep31

Freebsd ≫ Freebsd Version9.3 Updatep32

Freebsd ≫ Freebsd Version9.3 Updatep33

Freebsd ≫ Freebsd Version9.3 Updatep34

Freebsd ≫ Freebsd Version9.3 Updatep35

Freebsd ≫ Freebsd Version9.3 Updatep36

Freebsd ≫ Freebsd Version9.3 Updatep38

Freebsd ≫ Freebsd Version9.3 Updatep39

Freebsd ≫ Freebsd Version9.3 Updatep5

Freebsd ≫ Freebsd Version9.3 Updatep6

Freebsd ≫ Freebsd Version9.3 Updatep7

Freebsd ≫ Freebsd Version9.3 Updatep8

Freebsd ≫ Freebsd Version9.3 Updatep9

Freebsd ≫ Freebsd Version10.1 Update-

Freebsd ≫ Freebsd Version10.1 Updatep1

Freebsd ≫ Freebsd Version10.1 Updatep10

Freebsd ≫ Freebsd Version10.1 Updatep12

Freebsd ≫ Freebsd Version10.1 Updatep15

Freebsd ≫ Freebsd Version10.1 Updatep16

Freebsd ≫ Freebsd Version10.1 Updatep17

Freebsd ≫ Freebsd Version10.1 Updatep18

Freebsd ≫ Freebsd Version10.1 Updatep19

Freebsd ≫ Freebsd Version10.1 Updatep2

Freebsd ≫ Freebsd Version10.1 Updatep22

Freebsd ≫ Freebsd Version10.1 Updatep24

Freebsd ≫ Freebsd Version10.1 Updatep25

Freebsd ≫ Freebsd Version10.1 Updatep26

Freebsd ≫ Freebsd Version10.1 Updatep27

Freebsd ≫ Freebsd Version10.1 Updatep28

Freebsd ≫ Freebsd Version10.1 Updatep29

Freebsd ≫ Freebsd Version10.1 Updatep3

Freebsd ≫ Freebsd Version10.1 Updatep30

Freebsd ≫ Freebsd Version10.1 Updatep31

Freebsd ≫ Freebsd Version10.1 Updatep4

Freebsd ≫ Freebsd Version10.1 Updatep5

Freebsd ≫ Freebsd Version10.1 Updatep6

Freebsd ≫ Freebsd Version10.1 Updatep7

Freebsd ≫ Freebsd Version10.1 Updatep8

Freebsd ≫ Freebsd Version10.1 Updatep9

Freebsd ≫ Freebsd Version10.2 Update-

Freebsd ≫ Freebsd Version10.2 Updatep1

Freebsd ≫ Freebsd Version10.2 Updatep10

Freebsd ≫ Freebsd Version10.2 Updatep11

Freebsd ≫ Freebsd Version10.2 Updatep12

Freebsd ≫ Freebsd Version10.2 Updatep13

Freebsd ≫ Freebsd Version10.2 Updatep14

Freebsd ≫ Freebsd Version10.2 Updatep2

Freebsd ≫ Freebsd Version10.2 Updatep5

Freebsd ≫ Freebsd Version10.2 Updatep7

Freebsd ≫ Freebsd Version10.2 Updatep8

Freebsd ≫ Freebsd Version10.2 Updatep9

Freebsd ≫ Freebsd Version10.3 Update-

Siemens ≫ Simatic Net Cp 443-1 Opc Ua Firmware

Siemens ≫ Simatic Net Cp 443-1 Opc Ua Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	1.47%	0.8

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Patch

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Third Party Advisory

http://www.debian.org/security/2016/dsa-3629

Third Party Advisory

https://security.gentoo.org/glsa/201607-15

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html

https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf

Third Party Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11

http://www.ubuntu.com/usn/USN-3096-1

http://rhn.redhat.com/errata/RHSA-2016-1552.html

Broken Link

http://www.securitytracker.com/id/1035705

Third Party Advisory

VDB Entry

https://access.redhat.com/errata/RHSA-2016:1141

Third Party Advisory

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc

Third Party Advisory

https://security.netapp.com/advisory/ntap-20171004-0002/

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183647.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184669.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html

http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html

http://packetstormsecurity.com/files/136864/Slackware-Security-Advisory-ntp-Updates.html

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-ntpd

http://www.securityfocus.com/archive/1/538233/100/0/threaded

http://www.securityfocus.com/archive/1/archive/1/538233/100/0/threaded

https://www.debian.org/security/2016/dsa-3629

https://www.kb.cert.org/vuls/id/718152

Third Party Advisory

US Government Resource

http://support.ntp.org/bin/view/Main/NtpBug3009

Vendor Advisory

http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_ntp_4_2_8p7_Security

Vendor Advisory

http://www.securityfocus.com/bid/88226

Third Party Advisory

VDB Entry

https://support.f5.com/csp/article/K20804323

https://nvd.nist.gov/vuln/detail/CVE-2016-2518

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2016-2518

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2016-2518

EUVD