NTP BUG 2956: Small-step/big-step

Last update: June 28, 2022 20:06 UTC (57417e17c)


Summary

Resolved 4.2.8p5 07 Jan 2016
References Bug 2956 CVE-2015-5300
Affects All ntp-4 releases up to, but not including 4.2.8p5,
and 4.3.0 up to, but not including 4.3.78.
Resolved in 4.2.8p5.
CVSS2 Score MED 4.0 AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:L

Description

If ntpd is always started with the -g option, which is common and against long-standing recommendation, and if at the moment ntpd is restarted an attacker can immediately respond to enough requests from enough sources trusted by the target, which is difficult and not common, there is a window of opportunity where the attacker can cause ntpd to set the time to an arbitrary value. Similarly, if an attacker is able to respond to enough requests from enough sources trusted by the target, the attacker can cause ntpd to abort and restart, at which point it can tell the target to set the time to an arbitrary value if and only if ntpd was re-started against long-standing recommendation with the -g flag, or if ntpd was not given the -g flag, the attacker can move the target system’s time by at most 900 seconds' time per attack.


Mitigation


Credit

This weakness was discovered by Aanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg at Boston University.


Timeline