The following flaw was found in NTP: An off-path attacker can cause a preemptable client association to be demobilized by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled. Furthermore, if the attacker keeps sending crypto NAK packets, for example every one second, the victim never has a chance to reestablish the association and synchronize time with the legitimate server. Upstream bugs: http://support.ntp.org/bin/view/Main/NtpBug3007 External References: http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security http://www.talosintel.com/reports/TALOS-2016-0081/
In Fedora this bug was fixed in ntp-4.2.6p5-36.fc22 and ntp-4.2.6p5-36.fc23 as a part of the fix for CVE-2015-7979.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2016:1141 https://access.redhat.com/errata/RHSA-2016:1141
This issue has been addressed in the following products: Red Hat Enterprise Linux 6.7 Extended Update Support Via RHSA-2016:1552 https://rhn.redhat.com/errata/RHSA-2016-1552.html