CVE-2016-4953 - Bad authentication demobilizes ephemeral associations

Summary:
An attacker who knows the origin timestamp and can send a spoofed packet containing a CRYPTO-NAK to an ephemeral peer target before any other response is sent can demobilize that association.
CVSS3: LOW 3.7

Response: The flaw does not exist.

Authentication Manager is a client of time requests and not a server of time updates.

CVE-2016-4954 - Processing spoofed server packets

Summary: An attacker who is able to spoof packets with correct origin timestamps from enough servers before the expected response packets arrive at the target machine can affect some peer variables and, for example, cause a false leap indication to be set.
CVSS3: LOW 3.7

Response: The flaw does not exist.

Authentication Manager is a client of time requests and not a server of time updates.

CVE-2016-4955 - Autokey association reset

Summary: An attacker who is able to spoof a packet with a correct origin timestamp before the expected response packet arrives at the target machine can send a CRYPTO_NAK or a bad MAC and cause the association's peer variables to be cleared. If this can be done often enough, it will prevent that association from working.
CVSS3: LOW 3.7

Response: The flaw does not exist.

Authentication Manager is a client of time requests and not a server of time updates.

CVE-2016-4956 - Broadcast interleave

Summary: The fix for NTP Bug2978 CVE-2016-1548 does not cover broadcast associations, so broadcast clients can be triggered to flip into interleave mode.
CVSS3: LOW 3.7

Response: The flaw exists but cannot be exploited.

NTP on the Authentication Manager appliance is not configured as a broadcast client.