CVE-2016-2518: Medium severity Siemens SIMATIC NET CP 443-1 OPC UA vulnerability

Published Apr 28, 2016
·
Updated

The following flaw was found in ntpd:

Using a crafted packet to create a peer association with hmode > 7 causes the MATCHASSOC() lookup to make an out-of-bounds reference.

Upstream bugs:

http://support.ntp.org/bin/view/Main/NtpBug3009

External References:

http://support.ntp.org/bin/view/Main/SecurityNotice#April2016NTP428p7Security

Other sources

The MATCHASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.

Affected Software

130 affected componentsFixes available
debian/ntp
1:4.2.8p12+dfsg-41:4.2.8p15+dfsg-1
redhat/ntp<4.2.8
4.2.8
Siemens SIMATIC NET CP 443-1 OPC UA
NTP ntp<4.2.8
NTP ntp>=4.3.0<4.3.92
NTP ntp=4.2.8
NTP ntp=4.2.8-p1
NTP ntp=4.2.8-p1-beta1
NTP ntp=4.2.8-p1-beta2
NTP ntp=4.2.8-p1-beta3
NTP ntp=4.2.8-p1-beta4
NTP ntp=4.2.8-p1-beta5
NTP ntp=4.2.8-p1-rc1
NTP ntp=4.2.8-p1-rc2
NTP ntp=4.2.8-p2
NTP ntp=4.2.8-p2-rc1
NTP ntp=4.2.8-p2-rc2
NTP ntp=4.2.8-p2-rc3
NTP ntp=4.2.8-p3
NTP ntp=4.2.8-p3-rc1
NTP ntp=4.2.8-p3-rc2
NTP ntp=4.2.8-p3-rc3
NTP ntp=4.2.8-p4
NTP ntp=4.2.8-p5
NTP ntp=4.2.8-p6
NTP ntp=4.2.8-p7
NTP ntp=4.2.8-p8
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
NetApp Clustered Data ONTAP
NetApp Data Ontap 7-mode
NetApp OnCommand Balance
NetApp Oncommand Performance Manager
NetApp OnCommand Unified Manager for Clustered Data ONTAP
Oracle Communications User Data Repository=10.0.0
Oracle Communications User Data Repository=10.0.1
Oracle Communications User Data Repository=12.0.0
Oracle Linux=6
Oracle Linux=7
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Server=6.0
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Server Aus=7.2
redhat Enterprise Linux Server Aus=7.4
redhat Enterprise Linux Server Aus=7.6
redhat Enterprise Linux Server Eus=7.2
redhat Enterprise Linux Server Eus=7.3
redhat Enterprise Linux Server Eus=7.4
redhat Enterprise Linux Server Eus=7.5
redhat Enterprise Linux Server Eus=7.6
redhat Enterprise Linux Server Eus=7.7
redhat Enterprise Linux Server Tus=7.2
redhat Enterprise Linux Server Tus=7.3
redhat Enterprise Linux Server Tus=7.6
redhat Enterprise Linux Server Tus=7.7
redhat Enterprise Linux Workstation=6.0
FreeBSD FreeBSD=9.3
FreeBSD FreeBSD=9.3-p1
FreeBSD FreeBSD=9.3-p10
FreeBSD FreeBSD=9.3-p12
FreeBSD FreeBSD=9.3-p13
FreeBSD FreeBSD=9.3-p16
FreeBSD FreeBSD=9.3-p19
FreeBSD FreeBSD=9.3-p2
FreeBSD FreeBSD=9.3-p20
FreeBSD FreeBSD=9.3-p21
FreeBSD FreeBSD=9.3-p22
FreeBSD FreeBSD=9.3-p23
FreeBSD FreeBSD=9.3-p24
FreeBSD FreeBSD=9.3-p25
FreeBSD FreeBSD=9.3-p28
FreeBSD FreeBSD=9.3-p3
FreeBSD FreeBSD=9.3-p30
FreeBSD FreeBSD=9.3-p31
FreeBSD FreeBSD=9.3-p32
FreeBSD FreeBSD=9.3-p33
FreeBSD FreeBSD=9.3-p34
FreeBSD FreeBSD=9.3-p35
FreeBSD FreeBSD=9.3-p36
FreeBSD FreeBSD=9.3-p38
FreeBSD FreeBSD=9.3-p39
FreeBSD FreeBSD=9.3-p5
FreeBSD FreeBSD=9.3-p6
FreeBSD FreeBSD=9.3-p7
FreeBSD FreeBSD=9.3-p8
FreeBSD FreeBSD=9.3-p9
FreeBSD FreeBSD=10.1
FreeBSD FreeBSD=10.1-p1
FreeBSD FreeBSD=10.1-p10
FreeBSD FreeBSD=10.1-p12
FreeBSD FreeBSD=10.1-p15
FreeBSD FreeBSD=10.1-p16
FreeBSD FreeBSD=10.1-p17
FreeBSD FreeBSD=10.1-p18
FreeBSD FreeBSD=10.1-p19
FreeBSD FreeBSD=10.1-p2
FreeBSD FreeBSD=10.1-p22
FreeBSD FreeBSD=10.1-p24
FreeBSD FreeBSD=10.1-p25
FreeBSD FreeBSD=10.1-p26
FreeBSD FreeBSD=10.1-p27
FreeBSD FreeBSD=10.1-p28
FreeBSD FreeBSD=10.1-p29
FreeBSD FreeBSD=10.1-p3
FreeBSD FreeBSD=10.1-p30
FreeBSD FreeBSD=10.1-p31
FreeBSD FreeBSD=10.1-p4
FreeBSD FreeBSD=10.1-p5
FreeBSD FreeBSD=10.1-p6
FreeBSD FreeBSD=10.1-p7
FreeBSD FreeBSD=10.1-p8
FreeBSD FreeBSD=10.1-p9
FreeBSD FreeBSD=10.2
FreeBSD FreeBSD=10.2-p1
FreeBSD FreeBSD=10.2-p10
FreeBSD FreeBSD=10.2-p11
FreeBSD FreeBSD=10.2-p12
FreeBSD FreeBSD=10.2-p13
FreeBSD FreeBSD=10.2-p14
FreeBSD FreeBSD=10.2-p2
FreeBSD FreeBSD=10.2-p5
FreeBSD FreeBSD=10.2-p7
FreeBSD FreeBSD=10.2-p8
FreeBSD FreeBSD=10.2-p9
FreeBSD FreeBSD=10.3
Siemens Simatic Net Cp 443-1 Opc Ua Firmware
Siemens SIMATIC NET CP 443-1 OPC UA
All of the following
Siemens Simatic Net Cp 443-1 Opc Ua Firmware
Siemens SIMATIC NET CP 443-1 OPC UA

Event History

Jan 30, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:59 PM
RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2016-2518?

CVE-2016-2518 is classified as a high severity vulnerability due to its potential to cause an out-of-bounds reference.

2

How do I fix CVE-2016-2518?

To fix CVE-2016-2518, update NTP to version 4.2.8p12 or later for Debian systems, or 4.2.8 for Red Hat systems.

3

What systems are affected by CVE-2016-2518?

CVE-2016-2518 affects various versions of NTP including those prior to 4.2.8 and covers distributions like Debian and Red Hat.

4

What types of attacks can exploit CVE-2016-2518?

CVE-2016-2518 can be exploited through crafted packets that result in denial of service or unauthorized operation of the NTP service.

5

When was CVE-2016-2518 discovered?

CVE-2016-2518 was publicly disclosed in April 2016.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203