Ntpsec · Ntpsec · CVE-2016-1551
**Name of the Vulnerable Software and Affected Versions**
NTP versions 4.2.8p3 and earlier
NTPsec version a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and earlier
**Description**
The issue arises because ntpd relies on the underlying operating system to protect it from requests that impersonate reference clocks. Since reference clocks are treated like other peers and stored in the same structure, any packet with a source IP address of a reference clock that reaches the receive() function will be treated as a trusted peer. This poses a risk to systems that lack typical martian packet filtering, which would block these packets, allowing an attacker to potentially control the time on the system.
**Recommendations**
For NTP version 4.2.8p3 and earlier, consider implementing martian packet filtering to block packets that impersonate reference clocks.
For NTPsec version a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and earlier, consider implementing martian packet filtering to block packets that impersonate reference clocks.
As a temporary workaround, consider restricting access to the receive() function to minimize the risk of exploitation.