CVE-2016-1551
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying...
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock's peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock's peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.
- Record
CVE-2016-1551- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-254
- Updated
- 2026-11-02
CVE List No score
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock's peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.
- Record
CVE-2016-1551- Updated
- 2026-11-02
EUVDEUVD-2016-2646 No score
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock's peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.
- Record
EUVD-2016-2646- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xhrh-m85j-g7hf
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying...
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock's peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.
- Record
GHSA-xhrh-m85j-g7hf- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock's peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.
- Record
CVE-2016-1551- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10181-1 No score
ntp-4.2.8p9-1.1 on GA media
These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10181-1- Updated
- 2026-11-02
Show 4 moreShow less
OSVSUSE-SU-2016:1278-1 No score
Security update for ntp
This update for ntp to 4.2.8p7 fixes the following issues:
- CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS.
- CVE-2016-1548, bsc#977461: Interleave-pivot
- CVE-2016-1549, bsc#977451: Sybil vulnerability: ephemeral association attack.
- CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks.
- CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability
- CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd.
- CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated.
- CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC.
- CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked.
- This update also improves the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974
Bugs fixed:
- Restrict the parser in the startup script to the first occurrance of 'keys' and 'controlkey' in ntp.conf (bsc#957226).
- Record
SUSE-SU-2016:1278-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1291-1 No score
Security update for ntp
This update for ntp to 4.2.8p7 fixes the following issues:
- CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS.
- CVE-2016-1548, bsc#977461: Interleave-pivot
- CVE-2016-1549, bsc#977451: Sybil vulnerability: ephemeral association attack.
- CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks.
- CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability
- CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd.
- CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated.
- CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC.
- CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked.
- This update also improves the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974
Bugs fixed:
- Restrict the parser in the startup script to the first occurrance of 'keys' and 'controlkey' in ntp.conf (bsc#957226).
- Record
SUSE-SU-2016:1291-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1471-1 No score
Security update for ntp
This update for ntp fixes the following issues:
-
Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by 'rcntp addserver'.
-
Update to 4.2.8p7 (bsc#977446):
- CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS.
- CVE-2016-1548, bsc#977461: Interleave-pivot
- CVE-2016-1549, bsc#977451: Sybil vulnerability: ephemeral association attack.
- CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks.
- CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability
- CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd.
- CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated.
- CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC.
- CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked.
- integrate ntp-fork.patch
- Improve the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974
-
Restrict the parser in the startup script to the first occurrance of 'keys' and 'controlkey' in ntp.conf (bsc#957226).
- Record
SUSE-SU-2016:1471-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1568-1 No score
Security update for ntp
ntp was updated to version 4.2.8p8 to fix 17 security issues.
These security issues were fixed:
- CVE-2016-4956: Broadcast interleave (bsc#982068).
- CVE-2016-2518: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC (bsc#977457).
- CVE-2016-2519: ctl_getitem() return value not always checked (bsc#977458).
- CVE-2016-4954: Processing spoofed server packets (bsc#982066).
- CVE-2016-4955: Autokey association reset (bsc#982067).
- CVE-2015-7974: NTP did not verify peer associations of symmetric keys when authenticating packets, which might allowed remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a 'skeleton key (bsc#962960).
- CVE-2016-4957: CRYPTO_NAK crash (bsc#982064).
- CVE-2016-2516: Duplicate IPs on unconfig directives will cause an assertion botch (bsc#977452).
- CVE-2016-2517: Remote configuration trustedkey/requestkey values are not properly validated (bsc#977455).
- CVE-2016-4953: Bad authentication demobilizes ephemeral associations (bsc#982065).
- CVE-2016-1547: CRYPTO-NAK DoS (bsc#977459).
- CVE-2016-1551: Refclock impersonation vulnerability, AKA: refclock-peering (bsc#977450).
- CVE-2016-1550: Improve NTP security against buffer comparison timing attacks, authdecrypt-timing, AKA: authdecrypt-timing (bsc#977464).
- CVE-2016-1548: Interleave-pivot - MITIGATION ONLY (bsc#977461).
- CVE-2016-1549: Sybil vulnerability: ephemeral association attack, AKA: ntp-sybil - MITIGATION ONLY (bsc#977451).
This release also contained improved patches for CVE-2015-7704, CVE-2015-7705, CVE-2015-7974.
These non-security issues were fixed:
- bsc#979302: Change the process name of the forking DNS worker process to avoid the impression that ntpd is started twice.
- bsc#981422: Don't ignore SIGCHILD because it breaks wait().
- bsc#979981: ntp-wait does not accept fractional seconds, so use 1 instead of 0.2 in ntp-wait.service.
- Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by 'rcntp addserver'.
- bsc#957226: Restrict the parser in the startup script to the first occurrance of 'keys' and 'controlkey' in ntp.conf.
- Record
SUSE-SU-2016:1568-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ntpSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 12 CVEs |
before 4.2.8p7-11.1 | 4.2.8p7-11.1 |
ntpSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 12 CVEs |
before 4.2.8p7-11.1 | 4.2.8p7-11.1 |
ntpSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 12 CVEs |
before 4.2.8p7-11.1 | 4.2.8p7-11.1 |
ntpSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 12 CVEs |
before 4.2.8p7-11.1 | 4.2.8p7-11.1 |
ntpSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 12 CVEs |
before 4.2.8p7-11.1 | 4.2.8p7-11.1 |
ntpSUSE:OpenStack Cloud 5 From an advisory covering 12 CVEs |
before 4.2.8p7-44.1 | 4.2.8p7-44.1 |
ntpSUSE:Manager 2.1 From an advisory covering 12 CVEs |
before 4.2.8p7-44.1 | 4.2.8p7-44.1 |
ntpSUSE:Manager Proxy 2.1 From an advisory covering 12 CVEs |
before 4.2.8p7-44.1 | 4.2.8p7-44.1 |
ntpSUSE:Linux Enterprise Server 11 SP2-LTSS From an advisory covering 12 CVEs |
before 4.2.8p7-44.1 | 4.2.8p7-44.1 |
ntpSUSE:Linux Enterprise Server 11 SP3-LTSS From an advisory covering 12 CVEs |
before 4.2.8p7-44.1 | 4.2.8p7-44.1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ntpSUSE:Linux Enterprise Server 11 SP3-TERADATA From an advisory covering 12 CVEs |
before 4.2.8p7-44.1 | 4.2.8p7-44.1 |
ntpSUSE:Linux Enterprise Desktop 12 From an advisory covering 17 CVEs |
before 4.2.8p8-46.8.1 | 4.2.8p8-46.8.1 |
ntpSUSE:Linux Enterprise Server 12 From an advisory covering 17 CVEs |
before 4.2.8p8-46.8.1 | 4.2.8p8-46.8.1 |
ntpSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 17 CVEs |
before 4.2.8p8-46.8.1 | 4.2.8p8-46.8.1 |
ntpopenSUSE:Tumbleweed From an advisory covering 60 CVEs |
before 4.2.8p9-1.1 | 4.2.8p9-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-1551 is a low vulnerability (CVSS 3.7) in Ntp, published May 11, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.23%, the 82nd percentile. No source names a fixed version.
References
securityfocus.com/bid/88219
talosintelligence.com/reports/TALOS-2016-0132
securitytracker.com/id/1035705
oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
security.netapp.com/advisory/ntap-20171004-0002
security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc
Show 87 moreShow less
security.gentoo.org/glsa/201607-15
nvd.nist.gov/vuln/detail/CVE-2016-1551
github.com/advisories/GHSA-xhrh-m85j-g7hf
suse.com/support/update/announcement/2016/suse-su-20161278-1
bugzilla.suse.com/957226