CVE-2016-1548: Input Validation
An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.
Other sources
ntpd supports an interleaved mode to allow the protocol to exchange transmit timestamps that were captured after the packet was sent in symmetric associations and broadcast modes. It can be enabled in the configuration file, but it's also enabled automatically when a packet received from the source is detected to be in the interleaved mode. The detection compares the origin timestamp in the packet to the previous local receive timestamp. The interleaved mode is enabled even in client associations, even though it makes no sense there.
The problem is that the reference timestamp, which is revealed in all packets, is set to the local receive timestamp when the clock is updated. An off-path attacker can use ordinary client packets to monitor the server's reference timestamp and reference ID, wait for a clock update, and send the server a spoofed packet that will switch the association to the interleaved mode. This effectively disables the synchronization with the source as packets received from that point will not pass the checks used in the interleaved mode. The attack can be repeated for other sources when ntpd reselects. Unless the sources can be replaced (as with the pool directive for instance), the client will stay unsynchronized.
Upstream bugs:
http://support.ntp.org/bin/view/Main/NtpBug2978
External References:
http://support.ntp.org/bin/view/Main/SecurityNotice#April2016NTP428p7Security http://www.talosintel.com/reports/TALOS-2016-0082/
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-1548?
CVE-2016-1548 is rated as a medium severity vulnerability.
How do I fix CVE-2016-1548?
To fix CVE-2016-1548, upgrade to NTP versions 4.2.8p12+dfsg-4 or 4.2.8p15+dfsg-1.
What software is affected by CVE-2016-1548?
CVE-2016-1548 affects NTP versions 4.2.8p4 and earlier, including NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c.
What are the potential impacts of CVE-2016-1548?
The potential impact of CVE-2016-1548 includes the ability for an attacker to spoof legitimate ntpd server packets.
Is CVE-2016-1548 present in any specific products?
CVE-2016-1548 is present in various products, including certain Siemens TIM 4R-IE and SIMATIC NET CP 443-1 OPC UA devices.