CVE-2016-4957

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 44.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-07-05 · updated 2026-06-17
Weakness: CWE-476

Description

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.

Affected products

Novell Suse Manager: 2.1
NTP: 4.2.8-p7, 4.3.92
openSUSE Leap: 42.1
Opensuse: 13.2
Oracle Corporation Solaris Operating System: 10, 11.3
SUSE Linux Enterprise Server 15 SP1: 12-sp1
SUSE Linux Enterprise Server: 11-sp2, 11-sp3, 11-sp4, 12-sp1
SUSE Manager Proxy: 2.1
SUSE Openstack Cloud: 5

References

http://bugs.ntp.org/3046
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html
http://support.ntp.org/bin/view/Main/NtpBug3046
http://support.ntp.org/bin/view/Main/SecurityNotice
http://www.kb.cert.org/vuls/id/321640
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securitytracker.com/id/1036037
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:24.ntp.asc

Get alerted when CVE-2016-4957 or the next vulnerability affects your stack