Bug 1300266 (CVE-2015-7973) - CVE-2015-7973 ntp: replay attack on authenticated broadcast mode
Summary: CVE-2015-7973 ntp: replay attack on authenticated broadcast mode
Alias: CVE-2015-7973
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1300277
Blocks: 1297474
TreeView+ depends on / blocked
Reported: 2016-01-20 11:41 UTC by Martin Prpič
Modified: 2021-02-17 04:29 UTC (History)
3 users (show)

Fixed In Version: ntp 4.2.8p6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2016-01-21 15:23:57 UTC

Attachments (Terms of Use)

Description Martin Prpič 2016-01-20 11:41:17 UTC
It was found that when NTP is configured in broadcast mode, a man-in-the-middle attacker or a malicious client could replay packets received from the broadcast server to all (other) clients. This could cause the time on affected clients to become out of sync over a longer period of time.

Upstream patches:


Comment 2 Martin Prpič 2016-01-20 12:01:43 UTC
Created ntp tracking bugs for this issue:

Affects: fedora-all [bug 1300277]

Comment 3 Martin Prpič 2016-01-21 15:23:40 UTC
The issue described here is an inherent problem with securing packet transfer in broadcast mode. The man-in-the-middle attacker also must have access to the same network in which the packets are being broadcasted.


Do not use NTP's broadcast mode by not configuring the "broadcast" directive in the ntp.conf file.

Comment 4 Martin Prpič 2016-01-21 15:23:57 UTC

This issue affects the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue in Red Hat Enterprise Linux 6 and 7. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Note You need to log in before you can comment on or make changes to this bug.