K64505405 : NTP vulnerability CVE-2016-4956

Security Advisory Description

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548. (CVE-2016-4956)

Impact

In default configurations, F5 products are not vulnerable to this issue.

BIG-IP, Enterprise Manager, and BIG-IQ

This vulnerability can be exposed only if the ntp.conf file is manually edited to enable**broadcastclient **mode in the network time protocol (NTP).

Traffix SDC

This vulnerability may be exposed if the vulnerability is implemented in a closed client network where Traffix SDC is running with an NTP client configuration.