var-201607-0012
Vulnerability from variot
The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account. Meinberg NTP Time Server is prone to multiple privilege-escalation and stack-based buffer-overflow vulnerabilities. Remote attackers can exploit these issues to execute arbitrary code in the context of the application or gain elevated privileges. Other attacks are also possible. The following products are affected : Meinberg IMS-LANTIME M3000 Version 6.0 and prior Meinberg IMS-LANTIME M1000 Version 6.0 and prior Meinberg IMS-LANTIME M500 Version 6.0 and prior Meinberg LANTIME M900 Version 6.0 and prior Meinberg LANTIME M600 Version 6.0 and prior Meinberg LANTIME M400 Version 6.0 and prior Meinberg LANTIME M300 Version 6.0 and prior Meinberg LANTIME M200 Version 6.0 and prior Meinberg LANTIME M100 Version 6.0 and prior Meinberg SyncFire 1100 Version 6.0 and prior Meinberg LCES Version 6.0 and prior. Meinberg IMS-LANTIME M3000 etc. are all NTP time servers of German Meinberg company. An elevation of privilege vulnerability exists in the NTP time-server interface of several Meinberg products
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201607-0012",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lantime m400",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m900",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m1000",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m500",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m600",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m100",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m300",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lces",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "syncfire 1100",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m200",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m3000",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ntp server",
"scope": "lte",
"trust": 1.0,
"vendor": "meinberg",
"version": "6.0"
},
{
"model": "ims-lantime m1000",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ims-lantime m3000",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ims-lantime m500",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m100",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m200",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m300",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m400",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m600",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m900",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lces",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ntp server",
"scope": "lt",
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": "6.20.004"
},
{
"model": "syncfire 1100",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ntp server",
"scope": "eq",
"trust": 0.6,
"vendor": "meinberg",
"version": "6.0"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m1000",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m3000",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m500",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m100",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m200",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m300",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m400",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m600",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m900",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lces",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:meinberg:ntp_server_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:syncfire_1100",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ryan Wincey",
"sources": [
{
"db": "BID",
"id": "91400"
}
],
"trust": 0.3
},
"cve": "CVE-2016-3989",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2016-3989",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-92808",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2016-3989",
"impactScore": 5.2,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-3989",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2016-3989",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201606-553",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-92808",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account. Meinberg NTP Time Server is prone to multiple privilege-escalation and stack-based buffer-overflow vulnerabilities. \nRemote attackers can exploit these issues to execute arbitrary code in the context of the application or gain elevated privileges. Other attacks are also possible. \nThe following products are affected :\nMeinberg IMS-LANTIME M3000 Version 6.0 and prior\nMeinberg IMS-LANTIME M1000 Version 6.0 and prior\nMeinberg IMS-LANTIME M500 Version 6.0 and prior\nMeinberg LANTIME M900 Version 6.0 and prior\nMeinberg LANTIME M600 Version 6.0 and prior\nMeinberg LANTIME M400 Version 6.0 and prior\nMeinberg LANTIME M300 Version 6.0 and prior\nMeinberg LANTIME M200 Version 6.0 and prior\nMeinberg LANTIME M100 Version 6.0 and prior\nMeinberg SyncFire 1100 Version 6.0 and prior\nMeinberg LCES Version 6.0 and prior. Meinberg IMS-LANTIME M3000 etc. are all NTP time servers of German Meinberg company. An elevation of privilege vulnerability exists in the NTP time-server interface of several Meinberg products",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-3989"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "VULHUB",
"id": "VHN-92808"
}
],
"trust": 1.98
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-92808",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-3989",
"trust": 2.8
},
{
"db": "ICS CERT",
"id": "ICSA-16-175-03",
"trust": 2.5
},
{
"db": "EXPLOIT-DB",
"id": "40120",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553",
"trust": 0.7
},
{
"db": "BID",
"id": "91400",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-92808",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"id": "VAR-201607-0012",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T22:30:58.436000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Meinberg Security Advisory: [MBGSA-1604] WebUI and NTP",
"trust": 0.8,
"url": "https://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1604-webui-and-ntp.htm"
},
{
"title": "Multiple Meinberg Repair measures for product privilege vulnerability",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=62469"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-16-175-03"
},
{
"trust": 1.1,
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3989"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3989"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-92808"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-07-03T00:00:00",
"db": "VULHUB",
"id": "VHN-92808"
},
{
"date": "2016-06-23T00:00:00",
"db": "BID",
"id": "91400"
},
{
"date": "2016-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"date": "2016-06-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"date": "2016-07-03T14:59:05.523000",
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-03T00:00:00",
"db": "VULHUB",
"id": "VHN-92808"
},
{
"date": "2016-06-23T00:00:00",
"db": "BID",
"id": "91400"
},
{
"date": "2016-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"date": "2016-07-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"date": "2024-11-21T02:51:06.370000",
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Meinberg Runs on device firmware NTP Time Server Write to unspecified script in the interface root Privileged vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…