CVE-2016-1547: Input Validation
An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.
Other sources
The following flaw was found in NTP:
An off-path attacker can cause a preemptable client association to be demobilized by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.
Furthermore, if the attacker keeps sending crypto NAK packets, for example every one second, the victim never has a chance to reestablish the association and synchronize time with the legitimate server.
Upstream bugs:
http://support.ntp.org/bin/view/Main/NtpBug3007
External References:
http://support.ntp.org/bin/view/Main/SecurityNotice#April2016NTP428p7Security http://www.talosintel.com/reports/TALOS-2016-0081/
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-1547?
CVE-2016-1547 is rated as a medium severity vulnerability due to its potential for unauthorized association demobilization.
How do I fix CVE-2016-1547?
To mitigate CVE-2016-1547, upgrade NTP to version 4.2.8p12+dfsg-4 or later for Debian, or 4.2.8 version or later for Red Hat.
Which software versions are affected by CVE-2016-1547?
CVE-2016-1547 affects NTP versions up to and including 4.2.8p4, as well as various Siemens products that utilize vulnerable NTP versions.
Can CVE-2016-1547 be exploited remotely?
Yes, CVE-2016-1547 allows an off-path attacker to send spoofed packets to exploit the vulnerability.
What types of systems are impacted by CVE-2016-1547?
CVE-2016-1547 impacts systems running NTP versions prior to 4.2.8p12 and related Siemens products.