PublicDateAtUSN: 2016-12-31
Candidate: CVE-2016-9042
PublicDate: 2018-06-04 20:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9042
 https://www.talosintelligence.com/reports/TALOS-2016-0260/
 https://ubuntu.com/security/notices/USN-3349-1
Description:
 An exploitable denial of service vulnerability exists in the origin
 timestamp check functionality of ntpd 4.2.8p9. A specially crafted
 unauthenticated network packet can be used to reset the expected origin
 timestamp for target peers. Legitimate replies from targeted peers will
 fail the origin timestamp check (TEST2) causing the reply to be dropped and
 creating a denial of service condition.
Ubuntu-Description:
Notes:
 mdeslaur> ntp-4.2.8p9 (21 Nov 2016), up to but not including ntp-4.2.8p10
 mdeslaur> introduced in patch for CVE-2016-7431
Bugs:
 http://support.ntp.org/bin/view/Main/NtpBug3361
Priority: medium
Discovered-by: Matthew Van Gundy
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H [5.9 MEDIUM]
 nvd: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H [5.9 MEDIUM]

Patches_ntp:
 upstream: http://bk1.ntp.org/ntp-stable/?PAGE=cset&REV=58b56309OyBGP4pGEYHVzLh4VoQ8pg
upstream_ntp: released (1:4.2.8p10+dfsg-1)
precise_ntp: not-affected (1:4.2.6.p3+dfsg-1ubuntu3.11)
precise/esm_ntp: not-affected (1:4.2.6.p3+dfsg-1ubuntu3.11)
trusty_ntp: not-affected (1:4.2.6.p5+dfsg-3ubuntu2.14.04.10)
trusty/esm_ntp: not-affected (1:4.2.6.p5+dfsg-3ubuntu2.14.04.10)
vivid/stable-phone-overlay_ntp: ignored (reached end-of-life)
vivid/ubuntu-core_ntp: DNE
xenial_ntp: not-affected (1:4.2.8p4+dfsg-3ubuntu5.3)
esm-infra/xenial_ntp: not-affected (1:4.2.8p4+dfsg-3ubuntu5.3)
yakkety_ntp: released (1:4.2.8p8+dfsg-1ubuntu2.1)
zesty_ntp: released (1:4.2.8p9+dfsg-2ubuntu1.1)
devel_ntp: not-affected (1:4.2.8p10+dfsg-5ubuntu1)