CVE-2016-4957 Null dereference in n/a

High 7.5 Published 5 Jul 2016 Updated 6 Aug 2024

Remote attackers can crash the NTP daemon via a crypto-NAK packet, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-4957?

CVE-2016-4957 is a high-severity vulnerability in Ntp Ntp, published on 5 Jul 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.

Weakness: CWE-476

Which versions are affected by CVE-2016-4957?

It affects 9 products.

Products include Novell Suse Manager, Ntp Ntp, Opensuse Leap, Opensuse Opensuse, Oracle Solaris, Suse Linux Enterprise Desktop and 3 more.

How do I fix CVE-2016-4957?

Upgrade to a fixed version.

Is CVE-2016-4957 being exploited?

There is no known exploitation of CVE-2016-4957 in the wild and no public exploit code.

All Ntp Ntp vulnerabilities

Sources

Also known as DEBIAN-CVE-2016-4957, GHSA-3mq4-x52h-fcwc.