CVE-2016-1547 in Ubuntu

CVE-2016-1547

Priority

Description

An off-path attacker can cause a preemptible client association to be
demobilized in NTP 4.2.8p4 and earlier and NTPSec
a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to
a victim client with a spoofed source address of an existing associated
peer. This is true even if authentication is enabled.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1547
http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security
https://ubuntu.com/security/notices/USN-3096-1

Bugs

http://support.ntp.org/bin/view/Main/NtpBug3007

Notes

mdeslaur

fedora patch for CVE-2015-7979 also covers this CVE

Package

Source: ntp (LP Ubuntu Debian)

Upstream:	released (1:4.2.8p7+dfsg-1)
Ubuntu 16.04 ESM:	released (1:4.2.8p4+dfsg-3ubuntu5.3)
Ubuntu 14.04 ESM:	released (1:4.2.6.p5+dfsg-3ubuntu2.14.04.10)
Ubuntu 20.04 FIPS Compliant:	not-affected (1:4.2.8p4+dfsg-3ubuntu6)

Patches:

Upstream:	http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=56ca82fbM-SM7MAKmqf27DRTW1r6KQ
Upstream:	http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=5719625aNcSIWNqKMs4tNUS8r4xp-Q
Vendor:	http://pkgs.fedoraproject.org/cgit/rpms/ntp.git/tree/ntp-4.2.6p5-cve-2015-7979.patch

More Information

Updated: 2022-04-13 12:11:41 UTC (commit f411bd370d482ef4385c4e751d121a4055fbc009)