Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks.
Created ntp tracking bugs for this issue: Affects: fedora-all [bug 1703342]
This is a weakness in the protocol.
Mitigation: On Red Hat Enterprise Linux 6 and later, switching from ntp to chrony is recommended. Among other design improvements, chrony uses a randomised source port by default. If using ntp, the source port can be randomised by iptables masquerading rules, effectively mitigating this vulnerability: iptables -t nat -I POSTROUTING -p udp -m udp --sport 123 -j MASQUERADE --to-ports 60000-61000