An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp…
Priority LOW 38CWE-19Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.
Summary
An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.
Why it matters now
EPSS 0.03812 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 2 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NTP Project | NTP | 4.2.8p4 | — | No fix listed | CNA |
| NTP Project | NTPSec | aa48d001683e5b791a743ec9c575aaf7d867a2b0c | — | No fix listed | CNA |
- NTP VendorNTP Project Affected 4.2.8p4 Fixed in — No fix listed CNA
- NTPSec VendorNTP Project Affected aa48d001683e5b791a743ec9c575aaf7d867a2b0c Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ntp:ntp:4.2.8:p4:*:*:*:*:*:* | 4.2.8 p4 | Vulnerable | NTP Project |
- cpe:2.3:a:ntp:ntp:4.2.8:p4:*:*:*:*:*:* Versions 4.2.8 p4 Vulnerable ·NTP Project
Remediation
Red Hat 2 advisories
- RHSA-2016:1552 Released 2016-08-03 · Red Hat rating Moderatentp security update
- Red Hat Enterprise Linux HPC Node EUS (v. 6.7) ntp-4.2.6p5-5.el6_7.5, ntpdate-4.2.6p5-5.el6_7.5
- Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7) ntp-doc-4.2.6p5-5.el6_7.5, ntp-perl-4.2.6p5-5.el6_7.5
- Red Hat Enterprise Linux Server EUS (v. 6.7) ntp-4.2.6p5-5.el6_7.5, ntpdate-4.2.6p5-5.el6_7.5
- Red Hat Enterprise Linux Server Optional EUS (v. 6.7) ntp-doc-4.2.6p5-5.el6_7.5, ntp-perl-4.2.6p5-5.el6_7.5
- RHSA-2016:1141 Released 2016-05-31 · Red Hat rating Moderatentp security update
- Red Hat Enterprise Linux Client (v. 7) ntp-4.2.6p5-22.el7_2.2, ntpdate-4.2.6p5-22.el7_2.2
- Red Hat Enterprise Linux Client Optional (v. 7) ntp-doc-4.2.6p5-22.el7_2.2, ntp-perl-4.2.6p5-22.el7_2.2, sntp-4.2.6p5-22.el7_2.2
- Red Hat Enterprise Linux ComputeNode (v. 7) ntp-4.2.6p5-22.el7_2.2, ntpdate-4.2.6p5-22.el7_2.2
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ntp-doc-4.2.6p5-22.el7_2.2, ntp-perl-4.2.6p5-22.el7_2.2, sntp-4.2.6p5-22.el7_2.2
- Red Hat Enterprise Linux Desktop (v. 6) ntp-4.2.6p5-10.el6.1, ntpdate-4.2.6p5-10.el6.1
- Red Hat Enterprise Linux Desktop Optional (v. 6) ntp-doc-4.2.6p5-10.el6.1, ntp-perl-4.2.6p5-10.el6.1
- Red Hat Enterprise Linux HPC Node (v. 6) ntp-4.2.6p5-10.el6.1, ntpdate-4.2.6p5-10.el6.1
- Red Hat Enterprise Linux HPC Node Optional (v. 6) ntp-doc-4.2.6p5-10.el6.1, ntp-perl-4.2.6p5-10.el6.1
- Red Hat Enterprise Linux Server (v. 6) ntp-4.2.6p5-10.el6.1, ntpdate-4.2.6p5-10.el6.1
- Red Hat Enterprise Linux Server (v. 7) ntp-4.2.6p5-22.el7_2.2, ntpdate-4.2.6p5-22.el7_2.2
- Red Hat Enterprise Linux Server Optional (v. 6) ntp-doc-4.2.6p5-10.el6.1, ntp-perl-4.2.6p5-10.el6.1
- Red Hat Enterprise Linux Server Optional (v. 7) ntp-doc-4.2.6p5-22.el7_2.2, ntp-perl-4.2.6p5-22.el7_2.2, sntp-4.2.6p5-22.el7_2.2
- Red Hat Enterprise Linux Workstation (v. 6) ntp-4.2.6p5-10.el6.1, ntpdate-4.2.6p5-10.el6.1
- Red Hat Enterprise Linux Workstation (v. 7) ntp-4.2.6p5-22.el7_2.2, ntpdate-4.2.6p5-22.el7_2.2
- Red Hat Enterprise Linux Workstation Optional (v. 6) ntp-doc-4.2.6p5-10.el6.1, ntp-perl-4.2.6p5-10.el6.1
- Red Hat Enterprise Linux Workstation Optional (v. 7) ntp-doc-4.2.6p5-22.el7_2.2, ntp-perl-4.2.6p5-22.el7_2.2, sntp-4.2.6p5-22.el7_2.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux HPC Node EUS (v. 6.7) | Fixed | RHSA-2016:1552 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7) | Fixed | RHSA-2016:1552 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux Server EUS (v. 6.7) | Fixed | RHSA-2016:1552 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux Server Optional EUS (v. 6.7) | Fixed | RHSA-2016:1552 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2016:1141 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2016:1141 |
Not affected: 1 product
- Red Hat Enterprise Linux 5
Timeline
- 2026-10-02 Threatist record created from CVE-2016-1548
- 2026-10-03 Alias added: GHSA-fp4r-m88r-wmm8
- 2026-10-23 EPSS moved to the 90th–95th percentile
- 2026-10-25 EPSS moved to the 50th–90th percentile
- 2026-10-28 EPSS moved to the 90th–95th percentile
References
Advisory 19
- USN-3096-1
- DSA-3629
- RHSA-2016:1141
- SUSE-SU-2016:1912
- VU#718152
- RHSA-2016:1552
- 20160428 Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: April 2016
- FreeBSD-SA-16:16
- SUSE-SU-2016:2094
- openSUSE-SU-2016:1423
- GLSA-201607-15
- openSUSE-SU-2016:1329
- SUSE-SU-2016:1471
- FEDORA-2016-5b2eb0bf9c
- SUSE-SU-2016:1291
- DSA-3629
- SUSE-SU-2016:1568
- SUSE-SU-2016:1278
- FEDORA-2016-ed8c6c0426
Other 10
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- https://security.netapp.com/advisory/ntap-20171004-0002/
- http://packetstormsecurity.com/files/136864/Slackware-Security-Advisory-ntp-Updates.html
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0082
- https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
- https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11
- https://www.arista.com/en/support/advisories-notices/security-advisories/1332-security-advisory-19
More NTP Project Ntp vulnerabilities
- TI-2015-06541 Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows… CVSS 3.1CRITICAL 9.8
- TI-2014-07543 Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers… CVSS 2.0HIGH 7.5
- TI-2013-04524 The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote… CVSS 2.0MEDIUM 5.0
- TI-2016-06333 The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a… CVSS 3.1HIGH 7.5
- TI-2018-08842 Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker… CVSS 3.0CRITICAL 9.8
- TI-2016-04280 ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon… CVSS 3.1HIGH 7.5
Sources
- CVE-2016-1548 · CVE Program
- CVE-2016-1548 · NVD
- FIRST EPSS
- GHSA-fp4r-m88r-wmm8 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-1548 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences