CVE-2016-1548

An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.

• CWE-19

• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183647.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184669.html
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
• http://packetstormsecurity.com/files/136864/Slackware-Security-Advisory-ntp-Updates.html
• http://rhn.redhat.com/errata/RHSA-2016-1552.html
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-ntpd
• http://www.debian.org/security/2016/dsa-3629
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
• http://www.securityfocus.com/archive/1/538233/100/0/threaded
• http://www.securityfocus.com/archive/1/archive/1/538233/100/0/threaded
• http://www.securityfocus.com/bid/88264
• http://www.securitytracker.com/id/1035705
• http://www.talosintelligence.com/reports/TALOS-2016-0082/Exploit, Third Party Advisory
• http://www.ubuntu.com/usn/USN-3096-1
• https://access.redhat.com/errata/RHSA-2016:1141
• https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
• https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc
• https://security.gentoo.org/glsa/201607-15
• https://security.netapp.com/advisory/ntap-20171004-0002/
• https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
• https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11
• https://www.arista.com/en/support/advisories-notices/security-advisories/1332-security-advisory-19
• https://www.debian.org/security/2016/dsa-3629
• https://www.kb.cert.org/vuls/id/718152
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0082
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183647.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184669.html
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
• http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
• http://packetstormsecurity.com/files/136864/Slackware-Security-Advisory-ntp-Updates.html
• http://rhn.redhat.com/errata/RHSA-2016-1552.html
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-ntpd
• http://www.debian.org/security/2016/dsa-3629
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
• http://www.securityfocus.com/archive/1/538233/100/0/threaded
• http://www.securityfocus.com/archive/1/archive/1/538233/100/0/threaded
• http://www.securityfocus.com/bid/88264
• http://www.securitytracker.com/id/1035705
• http://www.talosintelligence.com/reports/TALOS-2016-0082/Exploit, Third Party Advisory
• http://www.ubuntu.com/usn/USN-3096-1
• https://access.redhat.com/errata/RHSA-2016:1141
• https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
• https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc
• https://security.gentoo.org/glsa/201607-15
• https://security.netapp.com/advisory/ntap-20171004-0002/
• https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
• https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11
• https://www.arista.com/en/support/advisories-notices/security-advisories/1332-security-advisory-19
• https://www.debian.org/security/2016/dsa-3629
• https://www.kb.cert.org/vuls/id/718152
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0082

Published

Jan 6, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1541Heap-based buffer overflow in the zip_read_mac_metadata func…
• CVE-2016-1542The RPC API in RSCD agent in BMC BladeLogic Server Automatio…
• CVE-2016-1543The RPC API in the RSCD agent in BMC BladeLogic Server Autom…
• CVE-2016-1544nghttp2 before 1.7.1 allows remote attackers to cause a deni…3.3
• CVE-2016-1546The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is …
• CVE-2016-1547An off-path attacker can cause a preemptible client associat…
• CVE-2016-1549A malicious authenticated peer can create arbitrarily-many e…
• CVE-2016-1550An exploitable vulnerability exists in the message authentic…
• CVE-2016-1551ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f4590048…
• CVE-2016-1555(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.…9.8
• CVE-2016-1556Information disclosure in Netgear WN604 before 3.3.3; WNAP21…
• CVE-2016-1557Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 revea…