CVE-2016-6301

The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.

• CWE-399
• CWE-835

• http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
• http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
• http://seclists.org/fulldisclosure/2019/Jun/18
• http://seclists.org/fulldisclosure/2019/Sep/7
• http://seclists.org/fulldisclosure/2020/Aug/20
• http://seclists.org/fulldisclosure/2020/Mar/15
• http://www.openwall.com/lists/oss-security/2016/08/03/7Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/92277Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1363710Issue Tracking, Third Party Advisory
• https://git.busybox.net/busybox/commit/?id=150dc7a2b483b8338a3e185c478b4b23ee884e71Issue Tracking, Patch
• https://seclists.org/bugtraq/2019/Jun/14
• https://seclists.org/bugtraq/2019/Sep/7
• https://security.gentoo.org/glsa/201701-05Third Party Advisory
• http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
• http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
• http://seclists.org/fulldisclosure/2019/Jun/18
• http://seclists.org/fulldisclosure/2019/Sep/7
• http://seclists.org/fulldisclosure/2020/Aug/20
• http://seclists.org/fulldisclosure/2020/Mar/15
• http://www.openwall.com/lists/oss-security/2016/08/03/7Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/92277Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1363710Issue Tracking, Third Party Advisory
• https://git.busybox.net/busybox/commit/?id=150dc7a2b483b8338a3e185c478b4b23ee884e71Issue Tracking, Patch
• https://seclists.org/bugtraq/2019/Jun/14
• https://seclists.org/bugtraq/2019/Sep/7
• https://security.gentoo.org/glsa/201701-05Third Party Advisory

Published

Dec 9, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6295ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, a…
• CVE-2016-6296Integer signedness error in the simplestring_addn function i…
• CVE-2016-6297Integer overflow in the php_stream_zip_opener function in ex…
• CVE-2016-6298The _Rsa15 class in the RSA 1.5 algorithm implementation in …5.3
• CVE-2016-6299The scm plug-in in mock might allow attackers to bypass the …
• CVE-2016-6300Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-6302The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL b…
• CVE-2016-6303Integer overflow in the MDC2_Update function in crypto/mdc2/…9.8
• CVE-2016-6304Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, …7.5
• CVE-2016-6305The ssl3_read_bytes function in record/rec_layer_s3.c in Ope…
• CVE-2016-6306The certificate parser in OpenSSL before 1.0.1u and 1.0.2 be…5.9
• CVE-2016-6307The state-machine implementation in OpenSSL 1.1.0 before 1.1…