VIR Vulnerability Intelligence Relay

CVE-2016-2517

medium
Published 2017-01-30 · Modified 2026-05-13
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
5.3
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.3

Description

NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression.

Predictions

Exploit likelihood
63%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
OSVersionStatusFixed in
suse slesaffected
debian debianbullseyefixed1:4.2.8p7+dfsg-1

Application impact
VendorProductVersionsFixed
ntpntp{"endIncluding":"4.2.8"}
ntpntp4.3.0
ntpntp4.3.1
ntpntp4.3.2
ntpntp4.3.3
ntpntp4.3.4
ntpntp4.3.5
ntpntp4.3.6
ntpntp4.3.7
ntpntp4.3.8
ntpntp4.3.9
ntpntp4.3.10
ntpntp4.3.11
ntpntp4.3.12
ntpntp4.3.13
ntpntp4.3.14
ntpntp4.3.15
ntpntp4.3.16
ntpntp4.3.17
ntpntp4.3.18
ntpntp4.3.19
ntpntp4.3.20
ntpntp4.3.21
ntpntp4.3.22
ntpntp4.3.23
ntpntp4.3.24
ntpntp4.3.25
ntpntp4.3.26
ntpntp4.3.27
ntpntp4.3.28
ntpntp4.3.29
ntpntp4.3.30
ntpntp4.3.31
ntpntp4.3.32
ntpntp4.3.33
ntpntp4.3.34
ntpntp4.3.35
ntpntp4.3.36
ntpntp4.3.37
ntpntp4.3.38
ntpntp4.3.39
ntpntp4.3.40
ntpntp4.3.41
ntpntp4.3.42
ntpntp4.3.43
ntpntp4.3.44
ntpntp4.3.45
ntpntp4.3.46
ntpntp4.3.47
ntpntp4.3.48
ntpntp4.3.49
ntpntp4.3.50
ntpntp4.3.51
ntpntp4.3.52
ntpntp4.3.53
ntpntp4.3.54
ntpntp4.3.55
ntpntp4.3.56
ntpntp4.3.57
ntpntp4.3.58
ntpntp4.3.59
ntpntp4.3.60
ntpntp4.3.61
ntpntp4.3.62
ntpntp4.3.63
ntpntp4.3.64
ntpntp4.3.65
ntpntp4.3.66
ntpntp4.3.67
ntpntp4.3.68
ntpntp4.3.69
ntpntp4.3.70
ntpntp4.3.71
ntpntp4.3.72
ntpntp4.3.73
ntpntp4.3.74
ntpntp4.3.75
ntpntp4.3.76
ntpntp4.3.77
ntpntp4.3.78
ntpntp4.3.79
ntpntp4.3.80
ntpntp4.3.81
ntpntp4.3.82
ntpntp4.3.83
ntpntp4.3.84
ntpntp4.3.85
ntpntp4.3.86
ntpntp4.3.87
ntpntp4.3.88
ntpntp4.3.89
ntpntp4.3.90
ntpntp4.3.91

References

CWEs

CWE-20

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.