What’s Vulnerable › Vulnerabilities

CVE-2016-2518

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 15.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-01-30 · updated 2026-06-17
• Weakness: CWE-125

Description

The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.

Affected products

• Debian Linux: 8.0, 9.0, 10.0
• FreeBSD: 9.3, 9.3-p1, 9.3-p10, 9.3-p12, 9.3-p13, 9.3-p16 (+63)
• Clustered Data ONTAP: all versions
• NetApp Data ONTAP operating in 7-Mode: all versions
• NetApp Oncommand Balance: all versions
• NetApp Oncommand Performance Manager: all versions
• NetApp Oncommand Unified Manager For Clustered Data Ontap: all versions
• NTP: before 4.2.8; from 4.3.0 before 4.3.92; 4.2.8, 4.2.8-p1, 4.2.8-p1-beta1, 4.2.8-p1-beta2, 4.2.8-p1-beta3, 4.2.8-p1-beta4 (+16) — fixed in 4.2.8, 4.3.92
• Oracle Communications User Data Repository: 10.0.0, 10.0.1, 12.0.0
• Oracle Corporation Oracle Linux: 6, 7
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Server Aus: 7.2, 7.4, 7.6
• RedHat Enterprise Linux Server Eus: 7.2, 7.3, 7.4, 7.5, 7.6, 7.7
• RedHat Enterprise Linux Server Tus: 7.2, 7.3, 7.6, 7.7
• RedHat Enterprise Linux Workstation: 6.0
• Siemens Simatic Net Cp 443-1 Opc Ua Firmware: all versions

How to fix

Upgrade to a fixed version: NTP 4.2.8, 4.3.92. Check the vendor advisory for mitigations.

References

• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183647.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184669.html
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
• http://packetstormsecurity.com/files/136864/Slackware-Security-Advisory-ntp-Updates.html
• http://rhn.redhat.com/errata/RHSA-2016-1552.html

Get alerted when CVE-2016-2518 or the next vulnerability affects your stack