CVE-2016-7434 in the critical feed json
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.
published 2017-01-13 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-8287
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 53.1%
- EPSS 53.1% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.
Patch / fix
- ntp ntp 4.2.8p9, 4.3.94
- hpe hpux-ntp c.4.2.8.2.0
- ntp Debian 11 1:4.2.8p9+dfsg-1
debian advisories DEBIAN-CVE-2016-7434
- ntp Ubuntu 16.04 LTS 1:4.2.8p4+dfsg-3ubuntu5.5
ubuntu advisories UBUNTU-CVE-2016-7434
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- ntp SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLES 11 SP2-LTSS +4 more 4.2.8p9-48.9.1
- ntp SLES for SAP 12 SP2, SLES for SAP 12 SP1, SLES for Raspberry Pi 12 SP2 +4 more 4.2.8p9-55.1
- ntp SLES for SAP 11 SP4, SLES 11 SP4 4.2.8p9-57.2
- ntp SLES for SAP 12, SLES 12-LTSS 4.2.8p9-46.18.1
suse advisories SUSE-SU-2017:0255-1SUSE-SU-2016:3195-1SUSE-SU-2016:3196-1SUSE-SU-2016:3193-1
- ntp openSUSE Tumbleweed 4.2.8p9-1.1
opensuse advisories openSUSE-SU-2024:10181-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2016-7434 updated cvss 5.3
ntp: read_mru_list() does inadequate incoming packet checks
-
Red Hat Enterprise Linux 5 ntp Red Hat Enterprise Linux 6 ntp, ntpdate, ntp-perl Red Hat Enterprise Linux 7 ntp, sntp, ntpdate, ntp-perlnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (EDB-40806)
- Published
Exploit prediction
53.09% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-40806 NTP 4.2.8p8 - Denial of Service dos, 2016-11-21
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
exploit-db.com
/exploits/40806/
exploit, third-party-advisory, vdb-entry
-
security.freebsd.org
/advisories/FreeBSD-SA-16:39.ntp.asc
vendor-advisory, third-party-advisory
-
support.ntp.org
/bin/view/Main/NtpBug3082
issue-tracking, mitigation, vendor-advisory
-
support.ntp.org
/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
release-notes, vendor-advisory
-
h20566.www2.hpe.com
/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03706en_us
third-party-advisory
-
securityfocus.com
/bid/94448
vdb-entry, third-party-advisory
-
nwtime.org
/ntp428p9_release/
third-party-advisory
-
kb.cert.org
/vuls/id/633847
third-party-advisory, us-government-resource
-
securitytracker.com
/id/1037354
vdb-entry, third-party-advisory
-
bto.bluecoat.com
/security-advisory/sa139
third-party-advisory
Sources
- CVE List CVE-2016-7434
- NVD CVE-2016-7434
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Adjust version ranges to reduce cpes in constraints.