NTP BUG 3118: Mode 6 unauthenticated trap information disclosure and DDoS vector

Last update: June 27, 2022 20:45 UTC (51d68a4aa)


Summary

Resolved 4.2.8p9 21 Nov 2016
References Bug 3118 CVE-2016-9310
Affects ntp-4.0.90 (21 July 1999), possibly earlier, up to but not
including ntp-4.2.8p9, and ntp-4.3.0 up to, but not including ntp-4.3.94.
Resolved in 4.2.8p9
CVSS2 Score MED 6.4 AV:A/AC:L/Au:N/C:N/I:N/A:P
CVSS3 Score MED 6.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Description

An exploitable configuration modification vulnerability exists in the control mode (mode 6) functionality of ntpd. If, against long-standing BCP recommendations, restrict default noquery ... is not specified, a specially crafted control mode packet can set ntpd traps, providing information disclosure and DDoS amplification, and unset ntpd traps, disabling legitimate monitoring. A remote, unauthenticated, network attacker can trigger this vulnerability.


Mitigation


Credit

This weakness was discovered by Matthew Van Gundy of Cisco.


Timeline