What’s Vulnerable › Vulnerabilities

CVE-2016-4956

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 16.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-07-05 · updated 2026-06-17

Description

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.

Affected products

• Novell Suse Manager: 2.1
• NTP: from 4.2.0 before 4.2.8; from 4.3.0 before 4.3.93; 4.2.8, 4.2.8-p1, 4.2.8-p1-beta1, 4.2.8-p1-beta2, 4.2.8-p1-beta3, 4.2.8-p1-beta4 (+15) — fixed in 4.2.8, 4.3.93
• openSUSE Leap: 42.1
• Opensuse: 13.2
• Oracle Corporation Solaris Operating System: 10, 11.3
• Siemens Simatic Net Cp 443-1 Opc Ua Firmware: all versions
• SUSE Linux Enterprise Server 15 SP1: 12-sp1
• SUSE Linux Enterprise Server: 11-sp2, 11-sp3, 11-sp4, 12-sp1
• SUSE Manager Proxy: 2.1
• SUSE Openstack Cloud: 5

How to fix

Upgrade to a fixed version: NTP 4.2.8, 4.3.93. Check the vendor advisory for mitigations.

References

• http://bugs.ntp.org/3042
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html
• http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
• http://packetstormsecurity.com/files/137321/Slackware-Security-Advisory-ntp-Updates.html
• http://support.ntp.org/bin/view/Main/NtpBug3042
• http://support.ntp.org/bin/view/Main/SecurityNotice

Get alerted when CVE-2016-4956 or the next vulnerability affects your stack