CVE-2018-7170: Medium severity NTP ntp vulnerability
ntpd can be vulnerable to Sybil attacks. If a system is set up to use a trustedkey and if one is not using the feature introduced in ntp-4.2.8p6 allowing an optional 4th field in the ntp.keys file to specify which IPs can serve time, a malicious authenticated peer -- i.e. one where the attacker knows the private symmetric key -- can create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock.
Ps.: This is possibly a incomplete fix for CVE-2016-1549.
References:
http://support.ntp.org/bin/view/Main/NtpBug3415
Other sources
ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ntpto a version that resolves this vulnerability.Fixed in 4.2.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2.8p7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.3.92 - Compensating control
If using ntp with a trustedkey/private symmetric key, ensure you are using the feature introduced in ntp-4.2.8p6 that allows an optional 4th field in the ntp.keys file to specify which IPs can serve time; do not leave it unused if you want to prevent Sybil attacks by malicious authenticated peers who know the private symmetric key.
Event History
Frequently Asked Questions
What is CVE-2018-7170?
CVE-2018-7170 is a vulnerability in ntpd which allows authenticated users to create arbitrary associations and modify a victim's clock via a Sybil attack.
Which versions of ntp are affected by CVE-2018-7170?
Versions of ntp before 4.2.8p7 and 4.3.x before 4.3.92 are affected by CVE-2018-7170.
How can an attacker exploit CVE-2018-7170?
An attacker with knowledge of the private symmetric key can exploit CVE-2018-7170 to create arbitrary associations and modify a victim's clock via a Sybil attack.
What is the severity of CVE-2018-7170?
The severity of CVE-2018-7170 is medium with a CVSS score of 5.3.
How can I fix CVE-2018-7170?
To fix CVE-2018-7170, it is recommended to update ntp to version 4.2.8p7 or 4.3.0 or later.