Is CVE-2016-9312 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-9312 being exploited in the wild.

How severe is CVE-2016-9312?

High severity, with a CVSS score of 7.5, published 13 January 2017.

Which products and versions are affected?

NTP Project Ntpd before 4.2.8p9.

Is there a fix for CVE-2016-9312?

A patch was published on 2016-11-21: NTP 4.2.8p9 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-9312 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2016-9312?

Check whether you run Microsoft Windows, Ntp or NTP Project Ntpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-9312: NTP Project ntpd denial of service via large UDP packet on Windows

CVE-2016-9312 · Severity: high · CVSS 7.5 · Published 2017-01-13

A vulnerability in the Network Time Protocol daemon (ntpd) on Windows systems allows a remote attacker to crash the service. This component is responsible for synchronizing the system clock across a network. If exploited, the time-keeping service will stop functioning, which can disrupt scheduled tasks, security logging, and authentication protocols that rely on accurate time.

Technologies: Microsoft Windows, Ntp, NTP Project Ntpd. Vendors: Microsoft, Ntp, NTP Project.

Quick answers

Is CVE-2016-9312 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-9312 being exploited in the wild.
How severe is CVE-2016-9312?: High severity, with a CVSS score of 7.5, published 13 January 2017.
Which products and versions are affected?: NTP Project Ntpd before 4.2.8p9.
Is there a fix for CVE-2016-9312?: A patch was published on 2016-11-21: NTP 4.2.8p9 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-9312 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2016-9312?: Check whether you run Microsoft Windows, Ntp or NTP Project Ntpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource management error (CWE-410/CWE-399) exists in the Windows implementation of ntpd. A remote, unauthenticated attacker can send a specially crafted, oversized UDP packet to the NTP port (typically 123/UDP). Upon receipt of this 'too big' packet, the ntpd process fails to handle the input correctly and terminates, resulting in a denial of service. This issue is specific to the Windows port of ntpd and was addressed in version 4.2.8p9.

Affected products

NTP Project ntpd before 4.2.8p9
Microsoft Windows

Timeline

2016-11-21: advisory: Initial release of CERT/CC vulnerability note
2016-11-21: patched: NTP 4.2.8p9 released to address the issue
2017-01-13: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.