7.1 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.965 High
EPSS
Percentile
99.6%
Multiple Cisco products incorporate a version of the Network Time Protocol daemon (ntpd) package. Versions of this package are affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or modify the time being advertised by a device acting as a Network Time Protocol (NTP) server.
On November 21, 2016, the NTP Consortium of the Network Time Foundation released a security notice that details ten issues regarding DoS vulnerabilities and logic issues that may allow an attacker to shift a system’s time.
The new vulnerabilities disclosed in this document are as follows:
Network Time Protocol Trap Service Denial of Service Vulnerability
Network Time Protocol Broadcast Mode Denial of Service Vulnerability
Network Time Protocol Broadcast Mode Denial of Service Vulnerability
Network Time Protocol Insufficient Resource Pool Denial of Service Vulnerability
Network Time Protocol Configuration Modification Denial of Service Vulnerability
Network Time Protocol mrulist Query Requests Denial of Service Vulnerability
Network Time Protocol Multiple Binds to the Same Port Vulnerability
Network Time Protocol Rate Limiting Denial of Service Vulnerability
As well as:
Regression of CVE-2015-8138
Network Time Protocol Reboot sync calculation problem
Additional details about each vulnerability are in the NTP Consortium Security Notice [“http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8p9_NTP_Se”].
Workarounds that address one or more of these vulnerabilities may be available and are documented in the Cisco bug for each affected product.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161123-ntpd [“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161123-ntpd”]
7.1 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.965 High
EPSS
Percentile
99.6%