Is CVE-2016-7431 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-7431 being exploited in the wild.

How severe is CVE-2016-7431?

Medium severity, with a CVSS score of 5.3, published 13 January 2017.

Which products and versions are affected?

Huawei eSpace VCN3000 V100R002C00SPC108, V100R002C10SPC108; Huawei FusionAccess V100R006C00B021, V100R006C00RC2, V100R006C10; Huawei FusionSphere OpenStack V100R005C00; Huawei iBMC V100R002C10; and 3 more.

Is there a fix for CVE-2016-7431?

A patch was published on 2016-11-21: NTP 4.2.8p9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-7431 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-7431?

Check whether you run Huawei eSpace VCN3000, Huawei FusionAccess, Huawei FusionSphere OpenStack or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-7431: NTP Project ntpd origin timestamp protection bypass

CVE-2016-7431 · Severity: medium · CVSS 5.3 · Published 2017-01-13

The Network Time Protocol (NTP) service, which synchronizes clocks across computer networks, contains a flaw in how it validates the origin of time updates. A remote attacker can bypass security checks by sending a specially crafted packet with a zeroed-out timestamp. This could allow an attacker to interfere with the accuracy of system time, potentially impacting time-sensitive operations and security logs.

Technologies: Ntp, NTP Project Ntpd. Vendors: Huawei, Ntp, NTP Project.

Quick answers

Is CVE-2016-7431 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-7431 being exploited in the wild.
How severe is CVE-2016-7431?: Medium severity, with a CVSS score of 5.3, published 13 January 2017.
Which products and versions are affected?: Huawei eSpace VCN3000 V100R002C00SPC108, V100R002C10SPC108; Huawei FusionAccess V100R006C00B021, V100R006C00RC2, V100R006C10; Huawei FusionSphere OpenStack V100R005C00; Huawei iBMC V100R002C10; and 3 more.
Is there a fix for CVE-2016-7431?: A patch was published on 2016-11-21: NTP 4.2.8p9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-7431 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-7431?: Check whether you run Huawei eSpace VCN3000, Huawei FusionAccess, Huawei FusionSphere OpenStack or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A regression in the timestamp validation logic of ntpd (originally intended to fix CVE-2015-8138) allows remote attackers to bypass origin timestamp protection. By sending an NTP packet with an origin timestamp of zero, an attacker can bypass the mechanism designed to ensure that a response corresponds to a legitimate recent request. This improper input validation (CWE-20) allows for unauthorized modification of time data. The vulnerability is resolved in NTP version 4.2.8p9.

Affected products

NTP Project ntpd before 4.2.8p9
Huawei FusionAccess V100R006C00B021, V100R006C00RC2, V100R006C10
Huawei FusionSphere OpenStack V100R005C00
Huawei OceanStor UDS V100R002C00LVDF01
Huawei RH5885 V3 V100R003C01, V100R003C01SPC200
Huawei eSpace VCN3000 V100R002C00SPC108, V100R002C10SPC108
Huawei iBMC V100R002C10

Timeline

2016-11-21: patched: NTP 4.2.8p9 released
2017-01-13: disclosed: NVD publication date
2017-11-29: advisory: Huawei secondary advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.