CERT-In Vulnerability Note
CIVN-2016-0308
Multiple Denial of Service Vulnerabilities in Network Time Protocol daemon
Original Issue Date:December 13, 2016
Severity Rating: MEDIUM
Systems Affected
- NTP ntpd prior to 4.2.8p9
Overview
Multiple vulnerabilities have been reported in Network Time Protocol (NTP) daemon which could be exploited by a remote attacker to cause denial of service conditions.
Description
1. Uncontrolled Resource Consumption Vulnerability
(
CVE-2016-7427
CVE-2016-7428
)
These vulnerabilities exist in broadcast mode of NTP due to its accessibility outside a trusted network. An attacker could exploit these vulnerabilities by accessing the NTP broadcast domain and periodically injecting specially crafted broadcast mode NTP packets into the broadcast domain , while being logged by ntpd. This could cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers. Successful exploitation of these vulnerabilities could allow an attacker to cause resulting in DoS condition.
2. Improper Input Validation Vulnerability
(
CVE-2016-7434
)
This vulnerability exists in NTP due to improper validation of inputs. If the ntpd is configured to allow mrulist query requests, a local attacker could exploit this vulnerability by sending crafted packets leading to a ntpd to crash resulting in Denial of Service (DoS) conditions.
3. Multiple Binds to the Same Port Vulnerability
(
CVE-2016-7429
)
This vulnerability exists in NTP due to improper improper validation of user-supplied data.
If the ntpd is on a host that has multiple interfaces in individual networks, a local attacker who knows the source address could exploit this vulnerability by sending a crafted packet containing a spoofed source address to the targeted system. Successful exploitation of this vulnerability could allow the attacker cause the ntpd to stop functioning, resulting in a DoS condition.
4. Insufficient Resource Pool Vulnerability
(
CVE-2016-7426
)
This vulnerability exists in NTP due to insufficient resource pooling when rate limiting for all associations is configured. A remote attacker could exploit this vulnerability by periodically sending packets with spoofed source address to keep the rate limiting activated and prevent ntpd from accepting valid responses from its sources. Successful exploitation of this vulnerability could allow an attacker to cause Denial of Service (DoS) conditions.
5. Root Delay Vulnerability
(
CVE-2016-7433
)
This vulnerability exists in NTP due to incorrect calculation of root delay causing the jitter value to be higher than expected resulting in misinterpretation of a small-print variable. Successful exploitation of this vulnerability could allow a remote attacker to cause Denial of Service (DoS) conditions.
6. Configuration Modification Vulnerability
(
CVE-2016-9310
)
This vulnerability exists in control mode functionality of ntpd due to its inability to specify long-standing BCP recommendations, "restrict default noquery". A remote attacker could exploit this vulnerability via specially crafted control mode packet to either set ntpd traps, resulting in information disclosure and DDoS amplification, or unset ntpd traps leading to disabling of legitimate monitoring.
Successful exploitation of this vulnerability could result in Denial of Service (DoS) conditions.
7. Trap Service Vulnerability
(
CVE-2016-9311
)
This vulnerability exists in ntpd due to improper handling of crafted packets when trap service is enabled. A remote attacker could exploit this vulnerability by sending a specially crafted packet to cause a null pointer dereference resulting in crashing of ntpd.
8. Insufficient Resource Pool Vulnerability
(
CVE-2016-9312
)
This vulnerability exists in NTP due to improper validation of user-supplied data. A remote attacker could exploit this vulnerability by sending a specially crafted packets resulting in ntpd to stop working.
Successful exploitation of this vulnerability could allow an attacker to cause DoS conditions.
Solution
Upgrade to 4.2.8p9 or later
Vendor Information
NTP
http://support.ntp.org/bin/view/Main/SecurityNotice
US CERT
https://www.kb.cert.org/vuls/id/633847
References
NTP
http://support.ntp.org/bin/view/Main/SecurityNotice
CVE Name
CVE-2016-9311
CVE-2016-9310
CVE-2016-7427
CVE-2016-7428
CVE-2016-9312
CVE-2016-7431
CVE-2016-7434
CVE-2016-7429
CVE-2016-7426
CVE-2016-7433
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|