# CVE-2016-7431: NTP Project ntpd origin timestamp protection bypass

Source: https://junglewise.ai/threats/cve-2016-7431-ntp-project-ntpd-origin-timestamp-protection-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-13. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-7431 · Severity: medium · CVSS 5.3 · Published 2017-01-13

The Network Time Protocol (NTP) service, which synchronizes clocks across computer networks, contains a flaw in how it validates the origin of time updates. A remote attacker can bypass security checks by sending a specially crafted packet with a zeroed-out timestamp. This could allow an attacker to interfere with the accuracy of system time, potentially impacting time-sensitive operations and security logs.

Technologies: [Ntp](https://junglewise.ai/threats/technologies/ntp), [NTP Project Ntpd](https://junglewise.ai/threats/technologies/ntpd). Vendors: [Huawei](https://junglewise.ai/threats/vendors/huawei), [Ntp](https://junglewise.ai/threats/vendors/ntp), [NTP Project](https://junglewise.ai/threats/vendors/ntp-project).

## Quick answers

**Is CVE-2016-7431 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-7431 being exploited in the wild.

**How severe is CVE-2016-7431?** Medium severity, with a CVSS score of 5.3, published 13 January 2017.

**Which products and versions are affected?** Huawei eSpace VCN3000 V100R002C00SPC108, V100R002C10SPC108; Huawei FusionAccess V100R006C00B021, V100R006C00RC2, V100R006C10; Huawei FusionSphere OpenStack V100R005C00; Huawei iBMC V100R002C10; and 3 more.

**Is there a fix for CVE-2016-7431?** A patch was published on 2016-11-21: NTP 4.2.8p9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-7431 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-7431?** Check whether you run Huawei eSpace VCN3000, Huawei FusionAccess, Huawei FusionSphere OpenStack or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A regression in the timestamp validation logic of ntpd (originally intended to fix CVE-2015-8138) allows remote attackers to bypass origin timestamp protection. By sending an NTP packet with an origin timestamp of zero, an attacker can bypass the mechanism designed to ensure that a response corresponds to a legitimate recent request. This improper input validation (CWE-20) allows for unauthorized modification of time data. The vulnerability is resolved in NTP version 4.2.8p9.

## Affected products

- NTP Project ntpd before 4.2.8p9
- Huawei FusionAccess V100R006C00B021, V100R006C00RC2, V100R006C10
- Huawei FusionSphere OpenStack V100R005C00
- Huawei OceanStor UDS V100R002C00LVDF01
- Huawei RH5885 V3 V100R003C01, V100R003C01SPC200
- Huawei eSpace VCN3000 V100R002C00SPC108, V100R002C10SPC108
- Huawei iBMC V100R002C10

## Timeline

- 2016-11-21: patched: NTP 4.2.8p9 released
- 2017-01-13: disclosed: NVD publication date
- 2017-11-29: advisory: Huawei secondary advisory published

## References

- [http://lists.opensuse.org/opensuse-updates/2016-12/msg00153.html](http://lists.opensuse.org/opensuse-updates/2016-12/msg00153.html)
- [http://nwtime.org/ntp428p9_release/](http://nwtime.org/ntp428p9_release/)
- [http://packetstormsecurity.com/files/140240/FreeBSD-Security-Advisory-FreeBSD-SA-16.39.ntp.html](http://packetstormsecurity.com/files/140240/FreeBSD-Security-Advisory-FreeBSD-SA-16.39.ntp.html)
- [http://support.ntp.org/bin/view/Main/NtpBug3102](http://support.ntp.org/bin/view/Main/NtpBug3102)
- [http://support.ntp.org/bin/view/Main/SecurityNotice](http://support.ntp.org/bin/view/Main/SecurityNotice)
- [http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171129-01-ntpd-en](http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171129-01-ntpd-en)
- [http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html](http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html)

## Related threats

- [NTP ntpd denial of service in ctl_getitem](https://junglewise.ai/threats/cve-2016-2519-ntp-ntpd-denial-of-service-in-ctl-getitem)
- [NTP ntpq protocol replay attack vulnerability](https://junglewise.ai/threats/cve-2015-8140-ntp-ntpq-protocol-replay-attack-vulnerability)
- [NTP ntpq origin timestamp leak and peer impersonation](https://junglewise.ai/threats/cve-2015-8139-ntp-ntpq-origin-timestamp-leak-and-peer-impersonation)
- [NTP Project ntpd origin timestamp validation bypass](https://junglewise.ai/threats/cve-2015-8138-ntp-project-ntpd-origin-timestamp-validation-bypass)
- [NTP Project ntpd denial of service via reslist command](https://junglewise.ai/threats/cve-2015-7977-ntp-project-ntpd-denial-of-service-via-reslist-command)