Ntp - vulnerabilities (CVEs)
99 CVEs in 2 products, 0 in the last 30 days, newest from 2023-04-11.
Products
Newest CVEs of Ntp
- CVE-2023-26552 - CVSS 5.6 (medium), 2023-04-11: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process,…
- CVE-2023-26555 - CVSS 6.4 (medium), 2023-04-11: praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver.
- CVE-2023-26551 - CVSS 5.6 (medium), 2023-04-11: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process,…
- CVE-2023-26554 - CVSS 5.6 (medium), 2023-04-11: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process,…
- CVE-2023-26553 - CVSS 5.6 (medium), 2023-04-11: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq…
- CVE-2020-15025 - CVSS 4.9 (medium), 2020-06-24: ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets,…
- CVE-2020-13817 - CVSS 7.4 (high), 2020-06-04: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting…
- CVE-2018-8956 - CVSS 5.3 (medium), 2020-05-06: ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP…
- CVE-2020-11868 - CVSS 7.5 (high), 2020-04-17: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a…
- CVE-2015-7851 - CVSS 6.5 (medium), 2020-01-28: Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/'…
- CVE-2014-5209 - CVSS 5.3 (medium), 2020-01-08: An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious…
- CVE-2019-8936 - CVSS 7.5 (high), 2019-05-15: NTP through 4.2.8p12 has a NULL Pointer Dereference.
- CVE-2019-11331 - CVSS 8.1 (high), 2019-04-18: Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for…
- CVE-2018-12327 - CVSS 9.8 (critical), 2018-06-20: Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long…
- CVE-2016-9042 - CVSS 5.9 (medium), 2018-06-04: An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network…
- CVE-2018-7183 - CVSS 9.8 (critical), 2018-03-08: Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq…
- CVE-2018-7184 - CVSS 7.5 (high), 2018-03-06: ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service…
- CVE-2018-7182 - CVSS 7.5 (high), 2018-03-06: The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6…
- CVE-2018-7170 - CVSS 5.3 (medium), 2018-03-06: ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral…
- CVE-2018-7185 - CVSS 7.5 (high), 2018-03-06: The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a…
- CVE-2015-5146 - CVSS 5.3 (medium), 2017-08-24: ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a…
- CVE-2015-3405 - CVSS 7.5 (high), 2017-08-09: ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest…
- CVE-2015-7705 - CVSS 9.8 (critical), 2017-08-07: The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted…
- CVE-2015-7852 - CVSS 5.9 (medium), 2017-08-07: ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.
- CVE-2015-7855 - CVSS 6.5 (medium), 2017-08-07: The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion…
- CVE-2015-7692 - CVSS 7.5 (high), 2017-08-07: The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This…
- CVE-2015-7704 - CVSS 7.5 (high), 2017-08-07: The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.
- CVE-2015-7850 - CVSS 6.5 (medium), 2017-08-07: ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing…
- CVE-2015-7854 - CVSS 8.8 (high), 2017-08-07: Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a…
- CVE-2015-7691 - CVSS 7.5 (high), 2017-08-07: The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted…
