Executive brief
A vulnerability in the Network Time Protocol (NTP) software can allow a remote attacker to disrupt time synchronization on servers with multiple network interfaces. By sending specially crafted responses, an attacker can prevent a system from communicating with its legitimate time sources. This can lead to inaccurate system clocks, which may impact time-sensitive operations, logging, and security protocols.
Technical details
A flaw exists in ntpd's handling of server responses on hosts configured with multiple network interfaces. When a response is received from a source, NTP incorrectly updates the peer structure to the interface on which the response was received. A remote attacker can exploit this by sending a spoofed response for a legitimate source to an interface that the source does not actually use. This causes ntpd to fail to synchronize with the legitimate source, resulting in a denial of service. The vulnerability is addressed in NTP version 4.2.8p9.
Affected products
- NTP Project ntp before 4.2.8p9
- Red Hat Enterprise Linux 6, 7
Timeline
- 2016-11-21: advisory: NTP Project release notes for 4.2.8p9
- 2017-01-13: disclosed: NVD publication date
- 2017-02-06: patched: Red Hat issued security updates RHSA-2017:0252
References
- http://nwtime.org/ntp428p9_release/
- http://rhn.redhat.com/errata/RHSA-2017-0252.html
- http://support.ntp.org/bin/view/Main/NtpBug3072
- http://support.ntp.org/bin/view/Main/SecurityNotice
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/bid/94453
- http://www.securitytracker.com/id/1037354