VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jan 6, 2017· Updated May 6, 2026

CVE-2016-1549

CVE-2016-1549

Description

A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An authenticated peer can create multiple ephemeral associations to manipulate ntpd's clock selection and alter a victim's time.

Vulnerability

In ntpd versions 4.2.8p4 and earlier, and NTPsec commits 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92, the daemon does not enforce a limit on the number of ephemeral associations that can be created under a single trusted symmetric key. This allows a malicious authenticated peer to mobilize arbitrarily many ephemeral associations from different source IP addresses, a Sybil attack [1].

Exploitation

An attacker must have knowledge of a trusted symmetric key shared with the victim ntpd process. The attacker sends authenticated requests from multiple source IP addresses, each causing ntpd to create a new ephemeral association advertising false time. If the number of malicious associations exceeds legitimate ones, the victim's clock selection algorithm will synchronize to the attacker's time [1].

Impact

Successful exploitation allows the attacker to modify the victim's clock, affecting time integrity. The CVSS v3 base score is 6.5 (Medium), with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N [1].

Mitigation

The vulnerability is fixed in NTP 4.2.8p5 and later releases. FreeBSD patches are available in versions 10.3-RELEASE-p1, 10.2-RELEASE-p15, and 9.3-RELEASE-p40 [2]. Gentoo recommends upgrading to net-misc/ntp-4.2.8_p8 or later [4]. No workaround is known.

References
  1. TALOS-2016-0083 || Cisco Talos Intelligence Group
  2. https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc
  3. Multiple vulnerabilities (GLSA 201607-15) — Gentoo security

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

30

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.