Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2016-5117: OpenNTPD <6.0p1 may trust fake HTTPS certificates
CVE-2016-5117 · published 9 years ago
Summary
The OpenNTPD version shipped with Debian before 6.0p1 does not verify the certificate name when handling HTTPS time‑constraint requests. This allows an attacker to present a counterfeit certificate and intercept or alter time data without detection. Upgrade OpenNTPD to version 6.0p1 or later to restore proper certificate checks.
What to do
- Update debian openntpd to version 1:6.0p1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | openntpd |
< 1:6.0p1-1 Fix: upgrade to 1:6.0p1-1
|
| Debian:13 | debian | openntpd |
< 1:6.0p1-1 Fix: upgrade to 1:6.0p1-1
|
| Debian:14 | debian | openntpd |
< 1:6.0p1-1 Fix: upgrade to 1:6.0p1-1
|
| – | openntpd | openntpd |
<= 6.0 cpe:2.3:a:openntpd:openntpd:*:*:*:*:*:*:*:* |
Original advisory text
OpenNTPD before 6.0p1 does not validate the CN for HTTPS constraint requests, which allows remote attackers to bypass the man-in-the-middle mitigations via a crafted timestamp constraint with a val...
OpenNTPD before 6.0p1 does not validate the CN for HTTPS constraint requests, which allows remote attackers to bypass the man-in-the-middle mitigations via a crafted timestamp constraint with a valid certificate.
References
- https://security-tracker.debian.org/tracker/CVE-2016-5117 Vendor Advisory
- http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ntpd/constraint.c.diff?r1=... Patch
- http://www.openntpd.org/txt/release-6.0p1.txt Vendor Advisory
- http://www.openwall.com/lists/oss-security/2016/05/23/2 Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/05/29/6 Mailing List Third Party Advisory
Severity
5.9
Medium
Type
CWE-2547PK - Security Features
Timeline
Published31 Jan 2017
Updated4 Nov 2026
First seen22 Sep 2026
Track software like this
Free during beta