PT-2018-2209 · Ntp+4 · Ntp+4
Published
2017-09-27
·
Updated
2025-01-14
·
CVE-2018-7170
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
ntp versions 4.2.x through 4.2.8p6
ntp versions 4.3.x through 4.3.91
Description
The issue is related to errors in key management in the ntpd implementation of the NTP protocol, allowing a remote attacker to impact the integrity of protected information. Specifically, authenticated users who know the private symmetric key can create multiple ephemeral associations to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This is due to an incomplete fix for a previous issue.
Recommendations
For ntp versions 4.2.x through 4.2.8p6, update to version 4.2.8p7 or later.
For ntp versions 4.3.x through 4.3.91, update to version 4.3.92 or later.
As a temporary workaround, consider restricting access to the private symmetric key to prevent authenticated users from creating multiple ephemeral associations.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Freebsd
Ibm Aix
Suse
Ntp