NT
Product
Ntp
99
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 36Medium 42Low 2
Watch
Add Ntp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-7851 | 6.5 | Jan 28 | Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for… Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.77; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +12 more |
| CVE-2015-7855 | 6.5 | Aug 7 | The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7… Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.77; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +13 more |
| CVE-2015-7850 | 6.5 | Aug 7 | ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the… Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.77; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +13 more |
| CVE-2015-7702 | 6.5 | Aug 7 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.77; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +13 more |
| CVE-2017-6464 | 6.5 | Mar 27 | NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive Affected: 4.2.8; 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; +34 more |
| CVE-2017-6463 | 6.5 | Mar 27 | NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to… Affected: 4.2.8; 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; +34 more |
| CVE-2015-7973 | 6.5 | Jan 30 | NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network Affected: before 4.2.8; 4.3.0 before 4.3.90; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +15 more |
| CVE-2016-9310 | 6.5 | Jan 13 | The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet Affected: through 4.2.8 |
| CVE-2016-1549 | 6.5 | Jan 6 | A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec… Affected: 4.2.8 |
| CVE-2023-26555 | 6.4 | Apr 11 | praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write Affected: 4.2.8 |
| CVE-2015-7975 | 6.2 | Jan 30 | The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service… Affected: through 4.2.8; 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; +34 more |
| CVE-2016-9042 | 5.9 | Jun 4 | An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9 Affected: 4.2.8 |
| CVE-2015-7852 | 5.9 | Aug 7 | ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.77; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +13 more |
| CVE-2016-2519 | 5.9 | Jan 30 | ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data value, which triggers the ctl_getitem… Affected: through 4.2.8; 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; +34 more |
| CVE-2015-8158 | 5.9 | Jan 30 | The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets… Affected: through 4.2.8; 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; +34 more |
| CVE-2015-7977 | 5.9 | Jan 30 | ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command Affected: through 4.2.8; 4.3.0 before 4.3.90; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +15 more |
| CVE-2016-9311 | 5.9 | Jan 13 | ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet Affected: through 4.2.8 |
| CVE-2016-4955 | 5.9 | Jul 5 | ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a… Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.93; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +17 more |
| CVE-2023-26554 | 5.6 | Apr 11 | mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character Affected: 4.2.8 |
| CVE-2023-26553 | 5.6 | Apr 11 | mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number Affected: 4.2.8 |
| CVE-2023-26552 | 5.6 | Apr 11 | mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point Affected: 4.2.8 |
| CVE-2023-26551 | 5.6 | Apr 11 | mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop Affected: 4.2.8 |
| CVE-2017-6459 | 5.5 | Mar 27 | The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes Affected: 4.2.8; 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; +34 more |
| CVE-2018-8956 | 5.3 | May 6 | ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode… Affected: 4.2.8; 4.2.8; 4.2.8; 4.2.8 |
| CVE-2014-5209 | 5.3 | Jan 8 | An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive… Affected: 4.2.7 |
| CVE-2018-7170 | 5.3 | Mar 6 | ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order… Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.92; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +16 more |
| CVE-2015-5146 | 5.3 | Aug 24 | ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to… Affected: through 4.2.8 |
| CVE-2016-2518 | 5.3 | Jan 30 | The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large… Affected: before 4.2.8; 4.3.0 before 4.3.92; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +18 more |
| CVE-2016-2517 | 5.3 | Jan 30 | NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or… Affected: through 4.2.8; 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; +34 more |
| CVE-2016-2516 | 5.3 | Jan 30 | NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times in… Affected: through 4.2.8; 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; +34 more |
| CVE-2015-8139 | 5.3 | Jan 30 | ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors Affected: through 4.2.8 |
| CVE-2015-8138 | 5.3 | Jan 30 | NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero Affected: through 4.2.8; 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; +34 more |
| CVE-2016-7433 | 5.3 | Jan 13 | NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance… Affected: through 4.2.8 |
| CVE-2016-7431 | 5.3 | Jan 13 | NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero Affected: 4.2.8 |
| CVE-2016-1550 | 5.3 | Jan 6 | An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 Affected: 4.2.8 |
| CVE-2016-1547 | 5.3 | Jan 6 | An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a… Affected: through 4.2.8 |
| CVE-2016-4956 | 5.3 | Jul 5 | ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.93; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +17 more |
| CVE-2020-15025 | 4.9 | Jun 24 | ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not… Affected: 4.3.97 before 4.3.101; 4.2.8; 4.2.8; 4.2.8; 4.2.8 |
| CVE-2015-8140 | 4.8 | Jan 30 | The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network Affected: through 4.2.8 |
| CVE-2015-7976 | 4.3 | Jan 30 | The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause… Affected: 4.1.2; through 4.2.8; 4.3.0; 4.3.1; 4.3.2; 4.3.3; +34 more |
| CVE-2016-7428 | 4.3 | Jan 13 | ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast packet Affected: 4.2.8; 4.2.8; 4.2.8 |
| CVE-2016-7427 | 4.3 | Jan 13 | The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via a crafted… Affected: 4.2.8; 4.2.8; 4.2.8 |
Showing 42