Junglewise Threat Intelligence

CVE-2015-8158: NTP ntpq infinite loop in getresponse function

CVE-2015-8158 · Severity: medium · CVSS 5.9 · Published 2017-01-30

Vendors: NTP Project.

Executive brief

A vulnerability in the Network Time Protocol (NTP) query utility could allow a remote attacker to disable the tool. By sending specially crafted network packets, an attacker can force the utility into an infinite loop, causing it to stop responding. This impacts the ability of administrators to monitor or configure time synchronization services on affected systems.

Technical details

A denial of service vulnerability exists in the ntpq utility of NTP versions before 4.2.8p9 and 4.3.x before 4.3.90. The flaw is located in the getresponse() function, which fails to properly sanitize input or validate exit conditions when processing incoming packets. A remote attacker can exploit this by sending crafted NTP packets with incorrect values, triggering an infinite loop (CWE-835). This results in the ntpq client becoming unresponsive or crashing. The vulnerability is reachable over the network without authentication, though successful exploitation may depend on the client actively querying a malicious or compromised server.

Affected products

  • NTP Project NTP before 4.2.8p9, 4.3.x before 4.3.90

Timeline

  • 2016-01-20: advisory: Initial upstream disclosure by NTP Project (Bug 2948)
  • 2016-07-25: patched: Debian released fixed packages in DSA-3629-1
  • 2016-11-03: patched: Red Hat released fixed packages in RHSA-2016:2583
  • 2017-01-30: disclosed: NVD publication date

References