NTP BUG 3045: Bad authentication demobilizes ephemeral associations

Last update: June 27, 2022 20:45 UTC (51d68a4aa)

Summary

Resolved 4.2.8p8 02 June 2016
References Bug 3045 CVE-2016-4953
Affects ntp-4, up to but not including ntp-4.2.8p8,
and ntp-4.3.0 up to, but not including ntp-4.3.93.		 Resolved in 4.2.8p8.
CVSS2 Score LOW 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P
CVSS3 Score LOW 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

An attacker who knows the origin timestamp and can send a spoofed packet containing a CRYPTO-NAK to an ephemeral peer target before any other response is sent can demobilize that association.

Mitigation

Credit

This weakness was discovered by Miroslav Lichvar of Red Hat.

Timeline