CVE-2016-7426

high · 7.5

NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.

7.5

CVSS

12.5%

EPSS (exploit prob.)

96th

EPSS percentile

2017-01-13

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-400

Affected products

Vendor	Product	Affected versions
ntp	ntp	>= 4.2.6, < 4.2.8
ntp	ntp	>= 4.3.0, < 4.3.94
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5
ntp	ntp	4.2.5

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-7426