7.5

CVE-2016-7426

NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.

Data is provided by the National Vulnerability Database (NVD)
NtpNtp Version >= 4.2.6 < 4.2.8
NtpNtp Version >= 4.3.0 < 4.3.94
NtpNtp Version4.2.5 Updatep203
NtpNtp Version4.2.5 Updatep204
NtpNtp Version4.2.5 Updatep205
NtpNtp Version4.2.5 Updatep206
NtpNtp Version4.2.5 Updatep207
NtpNtp Version4.2.5 Updatep208
NtpNtp Version4.2.5 Updatep209
NtpNtp Version4.2.5 Updatep210
NtpNtp Version4.2.5 Updatep211
NtpNtp Version4.2.5 Updatep212
NtpNtp Version4.2.5 Updatep213
NtpNtp Version4.2.5 Updatep214
NtpNtp Version4.2.5 Updatep215
NtpNtp Version4.2.5 Updatep216
NtpNtp Version4.2.5 Updatep217
NtpNtp Version4.2.5 Updatep218
NtpNtp Version4.2.5 Updatep219
NtpNtp Version4.2.5 Updatep220
NtpNtp Version4.2.5 Updatep221
NtpNtp Version4.2.5 Updatep222
NtpNtp Version4.2.5 Updatep223
NtpNtp Version4.2.5 Updatep224
NtpNtp Version4.2.5 Updatep225
NtpNtp Version4.2.5 Updatep226
NtpNtp Version4.2.5 Updatep227
NtpNtp Version4.2.5 Updatep228
NtpNtp Version4.2.5 Updatep229
NtpNtp Version4.2.5 Updatep230
NtpNtp Version4.2.5 Updatep231_rc1
NtpNtp Version4.2.5 Updatep232_rc1
NtpNtp Version4.2.5 Updatep233_rc1
NtpNtp Version4.2.5 Updatep234_rc1
NtpNtp Version4.2.5 Updatep235_rc1
NtpNtp Version4.2.5 Updatep236_rc1
NtpNtp Version4.2.5 Updatep237_rc1
NtpNtp Version4.2.5 Updatep238_rc1
NtpNtp Version4.2.5 Updatep239_rc1
NtpNtp Version4.2.5 Updatep240_rc1
NtpNtp Version4.2.5 Updatep241_rc1
NtpNtp Version4.2.5 Updatep242_rc1
NtpNtp Version4.2.5 Updatep243_rc1
NtpNtp Version4.2.5 Updatep244_rc1
NtpNtp Version4.2.5 Updatep245_rc1
NtpNtp Version4.2.5 Updatep246_rc1
NtpNtp Version4.2.5 Updatep247_rc1
NtpNtp Version4.2.5 Updatep248_rc1
NtpNtp Version4.2.5 Updatep249_rc1
NtpNtp Version4.2.5 Updatep250_rc1
NtpNtp Version4.2.8 Update-
NtpNtp Version4.2.8 Updatep1
NtpNtp Version4.2.8 Updatep1-beta1
NtpNtp Version4.2.8 Updatep1-beta2
NtpNtp Version4.2.8 Updatep1-beta3
NtpNtp Version4.2.8 Updatep1-beta4
NtpNtp Version4.2.8 Updatep1-beta5
NtpNtp Version4.2.8 Updatep1-rc1
NtpNtp Version4.2.8 Updatep1-rc2
NtpNtp Version4.2.8 Updatep2
NtpNtp Version4.2.8 Updatep2-rc1
NtpNtp Version4.2.8 Updatep2-rc2
NtpNtp Version4.2.8 Updatep2-rc3
NtpNtp Version4.2.8 Updatep3
NtpNtp Version4.2.8 Updatep3-rc1
NtpNtp Version4.2.8 Updatep3-rc2
NtpNtp Version4.2.8 Updatep3-rc3
NtpNtp Version4.2.8 Updatep4
NtpNtp Version4.2.8 Updatep5
NtpNtp Version4.2.8 Updatep6
NtpNtp Version4.2.8 Updatep7
NtpNtp Version4.2.8 Updatep8
CanonicalUbuntu Linux Version12.04 SwEditionesm
HpeHpux-ntp Version >= b.11.31 < c.4.2.8.2.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 38.91% 0.971
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.