CVE-2016-7427

Name of the Vulnerable Software and Affected Versions NTP versions prior to 4.2.8p9

Description The issue allows remote attackers to cause a denial of service (reject broadcast mode packets) via a crafted broadcast mode packet. It is also caused by a NULL pointer dereference when trap service has been enabled, allowing a remote attacker to exploit this vulnerability to cause the application to crash. Multiple vulnerabilities could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or modify the time being advertised by a device acting as a Network Time Protocol (NTP) server.

Recommendations For NTP versions prior to 4.2.8p9, update to version 4.2.8p9 or later to resolve the issue. As a temporary workaround, consider disabling the trap service to minimize the risk of exploitation. Restrict access to the broadcast mode to prevent crafted packets from causing a denial of service.