NTP.org’s reference implementation of NTP server, ntpd, contains multiple vulnerabilities.
CWE-294: Authentication Bypass by Capture-replay – CVE-2015-7973An attacker on the network can record and replay authenticated broadcast mode packets.
Also known as the “Deja Vu” attack.CWE-20: Improper Input Validation – CVE-2015-7974A missing key check allows impersonation between authenticated peers.
Also known as the “Skeleton Key” attack.CWE-20: Improper Input Validation – CVE-2015-7975The nextvar() function does not properly validate length.CWE-20: Improper Input Validation – CVE-2015-7976ntpq saveconfig command allows dangerous characters in filenamesCWE-476: NULL Pointer Dereference – CVE-2015-7977reslist NULL pointer dereferenceCWE-400: Uncontrolled Resource Consumption (‘Resource Exhaustion’) – CVE-2015-7978Stack exhaustion in recursive traversal of restriction listCWE-821: Incorrect Synchronization – CVE-2015-7979Off-path Denial of Service (DoS) attack on authenticated broadcast and other pre-emptable modesCWE-20: Improper Input Validation – CVE-2015-8138Zero Origin Timestamp BypassCWE-200: Information Exposure – CVE-2015-8139Network Time Protocol ntpq and ntpdc Origin Timestamp Disclosure Vulnerabilityhttp://support.ntp.org/bin/view/Main/NtpBug2946CWE-294: Authentication Bypass by Capture-replay – CVE-2015-8140Network Time Protocol ntpq Control Protocol Replay Vulnerabilityhttp://support.ntp.org/bin/view/Main/NtpBug2947CWE-400: Uncontrolled Resource Consumption (‘Resource Exhaustion’) – CVE-2015-8158Potential Infinite Loop in ntpqhttp://support.ntp.org/bin/view/Main/NtpBug2948CWE-821: Incorrect Synchronization – CVE-2016-1547An off-path attacker can deny service to ntpd clients by demobilizing preemptable associations using spoofed crypto-NAK packets. This vulnerability involves different code paths than those used by CVE-2015-7979.CWE-290: Authentication Bypass by Spoofing – CVE-2016-1548By spoofing packets from a legitimate server, an attacker can change the time of an ntpd client or deny service to an ntpd client by forcing it to change from basic client/server mode to interleaved symmetric mode.CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) – CVE-2016-1549ntpd does not prevent Sybil attacks from authenticated peers. An malicious authenticated peer can create any number of ephemeral associations in order to win ntpd’s clock selection algorithm and modify a victim’s clock.CWE-20: Improper Input Validation – CVE-2016-1550ntpd does not use a constant-time memory comparison function when validating the authentication digest on incoming packets. In some situations this may allow an attacker to conduct a timing attack to compute the value of the valid authentication digest causing forged packets to be accepted by ntpd.CWE-290: Authentication Bypass by Spoofing – CVE-2016-1551ntpd does not filter IPv4 bogon packets received from the network.
This allows unauthenticated network attackers to spoof refclock packets to ntpd processes on systems that do not implement bogon filtering.CWE-20: Improper Input Validation – CVE-2016-2516, CVE-2016-2517Duplicate IPs on unconfig directives will cause an assertion botch in ntpd.
A regression caused by the patch for CVE-2016-2516 was fixed and identified as CVE-2016-2517.CWE-125: Out-of-bounds Read – CVE-2016-2518Using a crafted packet to create a peer association with hmode > 7 causes the MATCH_ASSOC() lookup to make an out-of-bounds reference.CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer – CVE-2016-2519ntpq and ntpdc can be used to store and retrieve information in ntpd.
It is possible to store a data value that is larger than the size of the buffer that the ctl_getitem() function of ntpd uses to report the return value.
If the length of the requested data value returned by ctl_getitem() is too large, the value NULL is returned instead.
There are 2 cases where the return value from ctl_getitem() was not directly checked to make sure it’s not NULL, but there are subsequent INSIST() checks that make sure the return value is not NULL.
There are no data values ordinarily stored in ntpd that would exceed this buffer length.
But if one has permission to store values and one stores a value that is “too large”, then ntpd will abort if an attempt is made to read that oversized value.CWE-20: Improper Input Validation – CVE-2015-7704, CVE-2015-7705An ntpd client that honors Kiss-of-Death (KoD) responses will honor KoD messages that have been forged by an attacker, causing it to delay or stop querying its servers for time updates.
Also, an attacker can forge packets that claim to be from the target and send them to servers often enough that a server that implements KoD rate limiting will send the target machine a KoD response to attempt to reduce the rate of incoming packets, or it may also trigger a firewall block at the server for packets from the target machine.
For either of these attacks to succeed, the attacker must know what servers the target is communicating with.
An attacker can be anywhere on the Internet and can frequently learn the identity of the target’s time source by sending the target a time query.
For more information on these vulnerabilities, please see NTP.org’s April 2016 security advisory as well as the January 2016 security advisory.