{"id":"CVE-2016-0727","aliases":["DEBIAN-CVE-2016-0727","EUVD-2016-0756","GHSA-c7qx-m9c7-8wm7","UBUNTU-CVE-2016-0727","USN-3096-1"],"status":"published","title":"The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS,...","description":"The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01254,"percentile":0.69675,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-264"],"published":"2016-01-22T00:00:00Z","modified":"2026-08-04T06:04:47Z","exploits":[{"source":"exploitdb","id":"EDB-41764","title":"NTP - Local Privilege Escalation","type":"local","platform":"linux","date":"2016-01-21","url":"https://www.exploit-db.com/exploits/41764"}],"fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.8p9+dfsg-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ntp","fixed_in":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ntp","fixed_in":["1:4.2.8p4+dfsg-3ubuntu5.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p9+dfsg-2"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3","1:4.2.6.p5+dfsg-3ubuntu2.14.04.5","1:4.2.6.p5+dfsg-3ubuntu2.14.04.6","1:4.2.6.p5+dfsg-3ubuntu2.14.04.7","1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p4+dfsg-3ubuntu5.3"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu8","1:4.2.6.p5+dfsg-3ubuntu8.1","1:4.2.6.p5+dfsg-3ubuntu9","1:4.2.8p4+dfsg-3ubuntu1","1:4.2.8p4+dfsg-3ubuntu2","1:4.2.8p4+dfsg-3ubuntu3","1:4.2.8p4+dfsg-3ubuntu4","1:4.2.8p4+dfsg-3ubuntu5","1:4.2.8p4+dfsg-3ubuntu5.1","1:4.2.8p4+dfsg-3ubuntu5.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.1","1:4.2.6.p5+dfsg-3ubuntu2.14.04.2","1:4.2.6.p5+dfsg-3ubuntu2.14.04.3","1:4.2.6.p5+dfsg-3ubuntu2.14.04.5","1:4.2.6.p5+dfsg-3ubuntu2.14.04.6","1:4.2.6.p5+dfsg-3ubuntu2.14.04.7","1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.8p4+dfsg-3ubuntu5.3"}]}],"versions":["1:4.2.6.p5+dfsg-3ubuntu8","1:4.2.6.p5+dfsg-3ubuntu8.1","1:4.2.6.p5+dfsg-3ubuntu9","1:4.2.8p4+dfsg-3ubuntu1","1:4.2.8p4+dfsg-3ubuntu2","1:4.2.8p4+dfsg-3ubuntu3","1:4.2.8p4+dfsg-3ubuntu4","1:4.2.8p4+dfsg-3ubuntu5","1:4.2.8p4+dfsg-3ubuntu5.1","1:4.2.8p4+dfsg-3ubuntu5.2"],"bundled":18}],"products":[{"vendor":"canonical","product":"ubuntu_linux"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-3096-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1382369","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://www.securitytracker.com/id/1034808","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://packetstormsecurity.com/files/141913/NTP-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://www.securityfocus.com/bid/81552","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1528050","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0727"},{"url":"https://github.com/advisories/GHSA-c7qx-m9c7-8wm7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-0727","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-0727","tags":["report"]},{"url":"http://www.halfdog.net/Security/2015/NtpCronjobUserNtpToRootPrivilegeEscalation/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3096-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7975","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7976","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8138","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2516","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4954","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4955","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4956","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-0727","description":"The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.","status":"published","published":"2017-04-14T18:00:00Z","modified":"2024-08-05T22:30:03.949Z","updated_at":"2026-11-02T14:33:37.446553Z"}],"euvd":[{"id":"EUVD-2016-0756","description":"The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.","status":"published","published":"2017-04-14T18:00:00Z","modified":"2024-08-05T22:30:03Z","updated_at":"2026-11-03T02:23:00.426765Z"}],"ghsa":[{"id":"GHSA-c7qx-m9c7-8wm7","title":"The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS,...","description":"The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.","status":"published","published":"2022-05-17T02:49:00Z","modified":"2023-01-27T05:06:24Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:42:54.564328Z"}],"nvd":[{"id":"CVE-2016-0727","description":"The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.","status":"published","published":"2017-04-14T18:59:00.173Z","modified":"2026-06-17T00:38:06.19Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:37.619685Z"}],"osv":[{"id":"CVE-2016-0727","description":"The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.","status":"published","published":"2017-04-14T18:59:00.173Z","modified":"2026-03-15T21:49:59.39402Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-0727","description":"The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.","status":"published","published":"2017-04-14T18:59:00.173Z","modified":"2026-08-04T06:04:47.242587434Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-0727","description":"The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.","status":"published","published":"2016-01-22T00:00:00Z","modified":"2026-02-04T02:41:49.364483Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"USN-3096-1","title":"ntp vulnerabilities","description":"Aanchal Malhotra discovered that NTP incorrectly handled authenticated\nbroadcast mode. A remote attacker could use this issue to perform a replay\nattack. (CVE-2015-7973)\n\nMatt Street discovered that NTP incorrectly verified peer associations of\nsymmetric keys. A remote attacker could use this issue to perform an\nimpersonation attack. (CVE-2015-7974)\n\nJonathan Gardner discovered that the NTP ntpq utility incorrectly handled\nmemory. An attacker could possibly use this issue to cause ntpq to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04\nLTS. (CVE-2015-7975)\n\nJonathan Gardner discovered that the NTP ntpq utility incorrectly handled\ndangerous characters in filenames. An attacker could possibly use this\nissue to overwrite arbitrary files. (CVE-2015-7976)\n\nStephen Gray discovered that NTP incorrectly handled large restrict lists.\nAn attacker could use this issue to cause NTP to crash, resulting in a\ndenial of service. (CVE-2015-7977, CVE-2015-7978)\n\nAanchal Malhotra discovered that NTP incorrectly handled authenticated\nbroadcast mode. A remote attacker could use this issue to cause NTP to\ncrash, resulting in a denial of service. (CVE-2015-7979)\n\nJonathan Gardner discovered that NTP incorrectly handled origin timestamp\nchecks. A remote attacker could use this issue to spoof peer servers.\n(CVE-2015-8138)\n\nJonathan Gardner discovered that the NTP ntpq utility did not properly\nhandle certain incorrect values. An attacker could possibly use this issue\nto cause ntpq to hang, resulting in a denial of service. (CVE-2015-8158)\n\nIt was discovered that the NTP cronjob incorrectly cleaned up the\nstatistics directory. A local attacker could possibly use this to escalate\nprivileges. (CVE-2016-0727)\n\nStephen Gray and Matthew Van Gundy discovered that NTP incorrectly\nvalidated crypto-NAKs. A remote attacker could possibly use this issue to\nprevent clients from synchronizing. (CVE-2016-1547)\n\nMiroslav Lichvar and Jonathan Gardner discovered that NTP incorrectly\nhandled switching to interleaved symmetric mode. A remote attacker could\npossibly use this issue to prevent clients from synchronizing.\n(CVE-2016-1548)\n\nMatthew Van Gundy, Stephen Gray and Loganaden Velvindron discovered that\nNTP incorrectly handled message authentication. A remote attacker could\npossibly use this issue to recover the message digest key. (CVE-2016-1550)\n\nYihan Lian discovered that NTP incorrectly handled duplicate IPs on\nunconfig directives. An authenticated remote attacker could possibly use\nthis issue to cause NTP to crash, resulting in a denial of service.\n(CVE-2016-2516)\n\nYihan Lian discovered that NTP incorrectly handled certail peer\nassociations. A remote attacker could possibly use this issue to cause NTP\nto crash, resulting in a denial of service. (CVE-2016-2518)\n\nJakub Prokes discovered that NTP incorrectly handled certain spoofed\npackets. A remote attacker could possibly use this issue to cause a denial\nof service. (CVE-2016-4954)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain packets\nwhen autokey is enabled. A remote attacker could possibly use this issue to\ncause a denial of service. (CVE-2016-4955)\n\nMiroslav Lichvar discovered that NTP incorrectly handled certain spoofed\nbroadcast packets. A remote attacker could possibly use this issue to\ncause a denial of service. (CVE-2016-4956)\n\nIn the default installation, attackers would be isolated by the NTP\nAppArmor profile.\n","status":"published","published":"2016-10-05T18:01:12Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}