Junglewise Threat Intelligence

CVE-2016-1551: NTP and NTPsec reference clock impersonation vulnerability

CVE-2016-1551 · Severity: low · CVSS 3.7 · Published 2017-01-27

Executive brief

A vulnerability in the Network Time Protocol (NTP) daemon could allow an attacker to manipulate the system time on affected servers. NTP is used to synchronize clocks across computer networks, and an exploit could disrupt time-sensitive operations or security protocols that rely on accurate timestamps. This issue occurs when the software fails to properly verify the source of time updates, though many modern operating systems provide built-in protections that mitigate this risk.

Technical details

The ntpd implementation in NTP 4.2.8p3 and specific versions of NTPsec fails to sufficiently validate packets claiming to originate from reference clocks (e.g., 127.127.x.x). Because reference clocks are stored in the same peer structure as network peers, a spoofed IPv4 packet with a source address matching a configured reference clock will be treated as a trusted peer if it reaches the receive() function. This vulnerability is exploitable if the host operating system lacks 'martian' packet filtering to block external packets with internal loopback source addresses. An attacker can use this to inject false time data into the system. The issue was addressed in later versions of NTP (e.g., 4.2.8p8) and by ensuring OS-level filtering.

Affected products

  • NTP Project NTP 4.2.8p3
  • NTPsec NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92

Timeline

  • 2016-01-07: disclosed: Vulnerability disclosed to CERT
  • 2016-04-26: advisory: Public release of Talos vulnerability report
  • 2017-01-27: disclosed: NVD publication date

References

Related threats