Is CVE-2016-1551 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-1551 being exploited in the wild.

How severe is CVE-2016-1551?

Low severity, with a CVSS score of 3.7, published 27 January 2017.

Which products and versions are affected?

NTP Project NTP 4.2.8p3; NTPsec NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92.

Is there a fix for CVE-2016-1551?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-1551 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-1551?

Check whether you run Ntp or Ntpsec. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-1551: NTP and NTPsec reference clock impersonation vulnerability

CVE-2016-1551 · Severity: low · CVSS 3.7 · Published 2017-01-27

A vulnerability in the Network Time Protocol (NTP) daemon could allow an attacker to manipulate the system time on affected servers. NTP is used to synchronize clocks across computer networks, and an exploit could disrupt time-sensitive operations or security protocols that rely on accurate timestamps. This issue occurs when the software fails to properly verify the source of time updates, though many modern operating systems provide built-in protections that mitigate this risk.

Technologies: Ntp, Ntpsec. Vendors: Ntp, Ntpsec.

Quick answers

Is CVE-2016-1551 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-1551 being exploited in the wild.
How severe is CVE-2016-1551?: Low severity, with a CVSS score of 3.7, published 27 January 2017.
Which products and versions are affected?: NTP Project NTP 4.2.8p3; NTPsec NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92.
Is there a fix for CVE-2016-1551?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-1551 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-1551?: Check whether you run Ntp or Ntpsec. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ntpd implementation in NTP 4.2.8p3 and specific versions of NTPsec fails to sufficiently validate packets claiming to originate from reference clocks (e.g., 127.127.x.x). Because reference clocks are stored in the same peer structure as network peers, a spoofed IPv4 packet with a source address matching a configured reference clock will be treated as a trusted peer if it reaches the receive() function. This vulnerability is exploitable if the host operating system lacks 'martian' packet filtering to block external packets with internal loopback source addresses. An attacker can use this to inject false time data into the system. The issue was addressed in later versions of NTP (e.g., 4.2.8p8) and by ensuring OS-level filtering.

Affected products

NTP Project NTP 4.2.8p3
NTPsec NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92

Timeline

2016-01-07: disclosed: Vulnerability disclosed to CERT
2016-04-26: advisory: Public release of Talos vulnerability report
2017-01-27: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.