CVE-2016-1548 Other in NTP

High 7.2 Published 6 Jan 2017 Updated 5 Aug 2024

Attackers can spoof NTP packets to force clients into a broken state, rejecting valid time updates and allowing time manipulation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-1548?

CVE-2016-1548 is a high-severity vulnerability in Ntp Ntp, published on 6 Jan 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.

Weakness: CWE-19

Which versions are affected by CVE-2016-1548?

It affects 1 product.

Products include Ntp Ntp.

How do I fix CVE-2016-1548?

Upgrade to a fixed version.

Is CVE-2016-1548 being exploited?

There is no known exploitation of CVE-2016-1548 in the wild and no public exploit code.

All Ntp Ntp vulnerabilities

Sources

Also known as DEBIAN-CVE-2016-1548, GHSA-fp4r-m88r-wmm8, UBUNTU-CVE-2016-1548.