Bug 1397328 (CVE-2016-7428)

Summary:	CVE-2016-7428 ntp: Broadcast Mode Poll Interval Enforcement DoS
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	apmukher, mlichvar, sardella, slawomir, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ntp-4.2.8p9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-12-20 04:20:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1397349

Description Adam Mariš 2016-11-22 10:32:26 UTC

The broadcast mode of NTP is expected to only be used in a trusted network. If the broadcast network is accessible to an attacker, a potentially exploitable denial of service vulnerability in ntpd's broadcast mode poll interval enforcement functionality can be abused. To limit abuse, ntpd restricts the rate at which each broadcast association will process incoming packets. ntpd will reject broadcast mode packets that arrive before the poll interval specified in the preceding broadcast packet expires. An attacker with access to the NTP broadcast domain can send specially crafted broadcast mode NTP packets to the broadcast domain which, while being logged by ntpd, will cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers.

External References:

http://support.ntp.org/bin/view/Main/NtpBug3113

Comment 1 Adam Mariš 2016-11-22 11:09:35 UTC

Created ntp tracking bugs for this issue:

Affects: fedora-all [bug 1397351]

Comment 2 Huzaifa S. Sidhpurwala 2016-12-14 08:13:15 UTC

Mitigation:

Only use broadcast mode on trusted networks.