Junglewise Threat Intelligence

CVE-2016-2516: NTP Project NTP denial of service in unconfig directive

CVE-2016-2516 · Severity: medium · CVSS 5.3 · Published 2017-01-30

Vendors: NTP Project.

Executive brief

A vulnerability in the Network Time Protocol (NTP) daemon could allow an attacker to crash the service, leading to a denial of service. NTP is a critical service used to synchronize clocks across computer networks; if it fails, systems may experience issues with security logging, authentication, and scheduled tasks. This specific issue occurs when the software is configured to allow remote configuration and receives a malformed command.

Technical details

A denial of service vulnerability exists in ntpd due to improper input validation when processing 'unconfig' directives. If ntpd is explicitly configured to allow remote configuration (which requires knowledge of the controlkey or requestkey) and mode7 is enabled, an attacker can trigger an assertion failure by providing the same IP address multiple times within an unconfig directive. This causes the ntpd process to abort. The vulnerability is tracked as NTP Bug 3011 and was fixed in versions 4.2.8p7 and 4.3.92. Exploitation requires the attacker to have network access and valid authentication credentials for remote configuration.

Affected products

  • NTP Project NTP 4.2.8 before 4.2.8p7, 4.3.x before 4.3.92

Timeline

  • 2016-04-27: patched: Fixes released in FreeBSD stable branches
  • 2016-04-29: advisory: FreeBSD Security Advisory SA-16:16 published
  • 2017-01-30: disclosed: NVD publication date

References