CVE-2016-2518
Medium
Description
The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Ntp
PublishedJan 30, 2017
First seenJan 30, 2017
How to fix
Update
- ntp ntp4.2.8, 4.3.92 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ntp ntp | v < 4.2.8, 4.3.0 ≤ v < 4.3.92, 4.2.8 | 4.2.8, 4.3.92 |
| debian debian_linux | 8.0, 9.0, 10.0 | — |
| netapp clustered_data_ontap | No range specified | — |
| netapp data_ontap | No range specified | — |
| netapp oncommand_balance | No range specified | — |
| netapp oncommand_performance_manager | No range specified | — |
| netapp oncommand_unified_manager_for_clustered_data_ontap | No range specified | — |
| oracle communications_user_data_repository | 10.0.0, 10.0.1, 12.0.0 | — |
| oracle linux | 6, 7 | — |
| redhat enterprise_linux_desktop | 7.0 | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_server_aus | 7.2, 7.4, 7.6 | — |
| redhat enterprise_linux_server_eus | 7.2, 7.3, 7.4, 7.5, 7.6, 7.7 | — |
| redhat enterprise_linux_server_tus | 7.2, 7.3, 7.6, 7.7 | — |
| redhat enterprise_linux_workstation | 6.0 | — |
| freebsd freebsd | 9.3, 10.1, 10.2, 10.3 | — |
| siemens simatic_net_cp_443-1_opc_ua_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.