CVE-2016-7433: NTP Project NTP denial of service in initial sync calculations

CVE-2016-7433 · Severity: medium · CVSS 5.3 · Published 2017-01-13

A vulnerability in the Network Time Protocol (NTP) software, which is used to synchronize clocks across computer networks, could allow a remote attacker to disrupt time synchronization. By sending specially crafted network packets, an attacker could cause the service to crash or fail to sync correctly, potentially leading to operational issues for systems that rely on accurate time for security logging or transaction processing.

Technologies: Ntp, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7. Vendors: Huawei, Ntp, Red Hat.

Quick answers

Is CVE-2016-7433 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2016-7433 being exploited in the wild.
How severe is CVE-2016-7433?
Medium severity, with a CVSS score of 5.3, published 13 January 2017.
Which products and versions are affected?
NTP Project NTP before 4.2.8p9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Huawei FusionAccess; and 1 more.
Is there a fix for CVE-2016-7433?
A patch was published on 2016-11-21: NTP 4.2.8p9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-7433 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2016-7433?
Check whether you run Huawei FusionAccess, Huawei FusionSphere OpenStack, Ntp or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Network Time Protocol daemon (ntpd) due to an incorrect implementation of root distance calculations. Specifically, a previous fix for a different bug (Bug 2085) resulted in a regression where the root distance calculation failed to include peer dispersion. A remote, unauthenticated attacker can exploit this by sending specially crafted spoofed packets to the target host. Successful exploitation can cause ntpd to fail to synchronize with its time sources or, in certain cases, cause the daemon to crash, resulting in a denial of service (DoS). The issue is resolved in NTP version 4.2.8p9.

Affected products

  • NTP Project NTP before 4.2.8p9
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Huawei FusionAccess
  • Huawei FusionSphere OpenStack

Timeline

  • 2016-11-21: patched: NTP 4.2.8p9 released
  • 2017-01-13: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.