CVE-2016-4956 json
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spo…
published 2016-07-05 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-5930
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 16.4%
- EPSS 16.4% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.
Patch / fix
- ntp ntp 4.2.8, 4.3.93
- ntp Debian 11 1:4.2.8p8+dfsg-1
debian advisories DEBIAN-CVE-2016-4956
- ntp Ubuntu 14.04 LTS 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10
- ntp Ubuntu 16.04 LTS 1:4.2.8p4+dfsg-3ubuntu5.3
ubuntu advisories UBUNTU-CVE-2016-4956
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- ntp SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLES 11 SP2-LTSS +3 more 4.2.8p8-47.3
- ntp SLES 12 SP1, SLES 11 SP4, SLED 12 SP1 +2 more 4.2.8p8-14.1
- ntp SLES for SAP 12, SLES 12, SLED 12 4.2.8p8-46.8.1
suse advisories SUSE-SU-2016:1602-1SUSE-SU-2016:1584-1SUSE-SU-2016:1568-1SUSE-SU-2016:1563-1
- ntp openSUSE Tumbleweed 4.2.8p9-1.1
opensuse advisories openSUSE-SU-2024:10181-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2016-4956 updated cvss 2.6
ntp: broadcast interleave (incomplete fix for CVE-2016-1548)
-
Red Hat Enterprise Linux 5 ntp Red Hat Enterprise Linux 6 ntp, ntpdate, ntp-perl Red Hat Enterprise Linux 7 ntp, sntp, ntpdate, ntp-perlaffected: workaround, no fix planned “Do not use NTP's broadcast mode in the clients by not configuring the "broadcastclient" directive in the ntp.conf file.”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-21-159-11 updated cvss 5.3
Siemens SIMATIC NET CP 443-1 OPC UA
-
Siemens SIMATIC CP 443-1 OPC UAaffected: mitigation, no fix planned
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
Exploit prediction
16.35% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
References
-
lists.opensuse.org
/opensuse-security-announce/2016-06/msg00028.html
vendor-advisory, mailing-list, third-party-advisory
-
ubuntu.com
/usn/USN-3096-1
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/WNWGCQLW2VY72NIUYMJOCAKJKTXHDUK2/
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-06/msg00023.html
vendor-advisory, mailing-list, third-party-advisory
-
security.freebsd.org
/advisories/FreeBSD-SA-16:24.ntp.asc
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-07/msg00026.html
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/ORAMN3Q7TVJ54MBYF75XCJOE3DP7LYHT/
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-06/msg00024.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-08/msg00042.html
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/K3EYJQHJZ2KTVQ7ICEFHXTLZ36MRASWX/
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-06/msg00040.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-06/msg00018.html
vendor-advisory, mailing-list, third-party-advisory
-
security.gentoo.org
/glsa/201607-15
vendor-advisory, third-party-advisory
-
tools.cisco.com
/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ntpd
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2016-06/msg00020.html
vendor-advisory
-
support.ntp.org
/bin/view/Main/NtpBug3042
vendor-advisory
-
bugs.ntp.org
/3042
issue-tracking, vendor-advisory
-
support.ntp.org
/bin/view/Main/SecurityNotice
release-notes, vendor-advisory
-
securityfocus.com
/bid/91009
vdb-entry, third-party-advisory
-
h20566.www2.hpe.com
/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03757en_us
third-party-advisory
-
securitytracker.com
/id/1036037
vdb-entry, third-party-advisory
-
oracle.com
/technetwork/topics/security/bulletinapr2016-2952098.html
third-party-advisory
-
kb.cert.org
/vuls/id/321640
third-party-advisory, us-government-resource
- packetstormsecurity.com /files/137321/Slackware-Security-Advisory-ntp-Updates.html
-
securityfocus.com
/archive/1/540683/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/538599/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/archive/1/540683/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/538600/100/0/threaded
mailing-list
-
kb.cert.org
/vuls/id/321640
third-party-advisory
-
securityfocus.com
/archive/1/archive/1/538599/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/archive/1/538600/100/0/threaded
mailing-list
-
cert-portal.siemens.com
/productcert/pdf/ssa-211752.pdf
third-party-advisory
- us-cert.cisa.gov /ics/advisories/icsa-21-159-11
Sources
- CVE List CVE-2016-4956
- NVD CVE-2016-4956
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.