Executive brief
A vulnerability in the Network Time Protocol daemon (ntpd) on Windows systems allows a remote attacker to crash the service. This component is responsible for synchronizing the system clock across a network. If exploited, the time-keeping service will stop functioning, which can disrupt scheduled tasks, security logging, and authentication protocols that rely on accurate time.
Technical details
A resource management error (CWE-410/CWE-399) exists in the Windows implementation of ntpd. A remote, unauthenticated attacker can send a specially crafted, oversized UDP packet to the NTP port (typically 123/UDP). Upon receipt of this 'too big' packet, the ntpd process fails to handle the input correctly and terminates, resulting in a denial of service. This issue is specific to the Windows port of ntpd and was addressed in version 4.2.8p9.
Affected products
- NTP Project ntpd before 4.2.8p9
- Microsoft Windows
Timeline
- 2016-11-21: advisory: Initial release of CERT/CC vulnerability note
- 2016-11-21: patched: NTP 4.2.8p9 released to address the issue
- 2017-01-13: disclosed: NVD publication date