NTP BUG 3119: Mode 6 unauthenticated trap information disclosure and DDoS vector

Last update: June 27, 2022 20:45 UTC (51d68a4aa)

---

Summary

Resolved	4.2.8p9	21 Nov 2016
References	Bug 3119	CVE-2016-9311
Affects	ntp-4.0.90 (21 July 1999), possibly earlier, up to but not including ntp-4.2.8p9, and ntp-4.3.0 up to, but not including ntp-4.3.94.	Resolved in 4.2.8p9.
CVSS2 Score	MED 4.9	AV:N/AC:H/Au:N/C:N/I:N/A:C
CVSS3 Score	MED 4.4	CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

---

Description

ntpd does not enable trap service by default. If trap service has been explicitly enabled, an attacker can send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service.

---

Mitigation

• Implement BCP-38.
• Use restrict default noquery ... in your ntp.conf file. Only allow mode 6 queries from trusted networks and hosts.
• Upgrade to 4.2.8p9 or later.
• Properly monitor your ntpd instances, and auto-restart ntpd (without -g) if it stops running.

---

Credit

This weakness was discovered by Matthew Van Gundy of Cisco.

---

Timeline

• 2016 Nov 21: Public release
• 2016 Nov 15: CERT given our software release notification
• 2016 Nov 14: Early Access Program Release: Premier and Partner Institutional Members
• : Notification to Institutional Members
• : Report received