CVE-2016-1547

An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.

• CWE-20

• http://rhn.redhat.com/errata/RHSA-2016-1552.html
• http://www.debian.org/security/2016/dsa-3629
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
• http://www.securityfocus.com/bid/88276
• http://www.securitytracker.com/id/1035705
• http://www.talosintelligence.com/reports/TALOS-2016-0081/Mitigation, Technical Description, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1141
• https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
• https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc
• https://security.gentoo.org/glsa/201607-15
• https://security.netapp.com/advisory/ntap-20171004-0002/
• https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
• https://www.arista.com/en/support/advisories-notices/security-advisories/1332-security-advisory-19
• http://rhn.redhat.com/errata/RHSA-2016-1552.html
• http://www.debian.org/security/2016/dsa-3629
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
• http://www.securityfocus.com/bid/88276
• http://www.securitytracker.com/id/1035705
• http://www.talosintelligence.com/reports/TALOS-2016-0081/Mitigation, Technical Description, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1141
• https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
• https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc
• https://security.gentoo.org/glsa/201607-15
• https://security.netapp.com/advisory/ntap-20171004-0002/
• https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
• https://www.arista.com/en/support/advisories-notices/security-advisories/1332-security-advisory-19

Published

Jan 6, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1531Exim before 4.86.2, when installed setuid root, allows local…
• CVE-2016-1541Heap-based buffer overflow in the zip_read_mac_metadata func…
• CVE-2016-1542The RPC API in RSCD agent in BMC BladeLogic Server Automatio…
• CVE-2016-1543The RPC API in the RSCD agent in BMC BladeLogic Server Autom…
• CVE-2016-1544nghttp2 before 1.7.1 allows remote attackers to cause a deni…3.3
• CVE-2016-1546The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is …
• CVE-2016-1548An attacker can spoof a packet from a legitimate ntpd server…
• CVE-2016-1549A malicious authenticated peer can create arbitrarily-many e…
• CVE-2016-1550An exploitable vulnerability exists in the message authentic…
• CVE-2016-1551ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f4590048…
• CVE-2016-1555(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.…9.8
• CVE-2016-1556Information disclosure in Netgear WN604 before 3.3.3; WNAP21…