Bug 1331463 (CVE-2016-1549) - CVE-2016-1549 ntp: ephemeral association time spoofing
Summary: CVE-2016-1549 ntp: ephemeral association time spoofing
Alias: CVE-2016-1549
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1332160
Blocks: 1331437
TreeView+ depends on / blocked
Reported: 2016-04-28 14:51 UTC by Martin Prpič
Modified: 2019-11-14 07:53 UTC (History)
8 users (show)

Fixed In Version: ntp 4.2.8p7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2016-05-30 13:39:23 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 2300641 None None None 2016-05-06 01:28:48 UTC

Description Martin Prpič 2016-04-28 14:51:41 UTC
The following flaw was found in ntpd:

ntpd can be vulnerable to Sybil attacks. If a system is set up to use a trustedkey and if one is not using the feature introduced in ntp-4.2.8p6 allowing an optional 4th field in the ntp.keys file to specify which IPs can serve time, a malicious authenticated peer -- i.e. one where the attacker knows the private symmetric key -- can create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock.

Upstream bugs:


External References:


Comment 1 Martin Prpič 2016-05-02 11:37:36 UTC
Created ntp tracking bugs for this issue:

Affects: fedora-all [bug 1332160]

Comment 3 Martin Prpič 2016-06-03 14:35:23 UTC

Red Hat Product Security has rated this issue as having Low security impact: to exploit this issue, an attacker must have access to a trustedkey if one is configured in the /etc/ntp.key file. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.


Assure only trusted hosts have access to the trustedkey.

Note You need to log in before you can comment on or make changes to this bug.