CVE-2016-7431

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-01-13 · updated 2026-06-17
Weakness: CWE-20

Description

NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero. NOTE: this vulnerability exists because of a CVE-2015-8138 regression.

Affected products

NTP: 4.2.8-p8

References

http://lists.opensuse.org/opensuse-updates/2016-12/msg00153.html
http://nwtime.org/ntp428p9_release/
http://packetstormsecurity.com/files/140240/FreeBSD-Security-Advisory-FreeBSD-SA-16.39.ntp.html
http://support.ntp.org/bin/view/Main/NtpBug3102
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171129-01-ntpd-en
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.securityfocus.com/archive/1/539955/100/0/threaded
http://www.securityfocus.com/archive/1/540254/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/539955/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/540254/100/0/threaded
http://www.securityfocus.com/bid/94454

Get alerted when CVE-2016-7431 or the next vulnerability affects your stack