CVE-2015-1798

Vulnerability

The symmetric-key authentication mechanism in ntpd's receive function (ntp_proto.c) in NTP versions 4.x before 4.2.8p2 only requires a correct Message Authentication Code (MAC) if the MAC field has a nonzero length. This flaw allows an attacker to bypass authentication by simply omitting the MAC field from packets [1][3][4].

Exploitation

An attacker with a man-in-the-middle position can send crafted NTP packets with a zero-length MAC field to a vulnerable ntpd that is configured for symmetric-key authentication. The server incorrectly accepts these packets as authentic, as the MAC validation is skipped [1][3].

Impact

Successful exploitation enables the attacker to spoof NTP packets, potentially altering the target's system time. This can lead to disruption of time-sensitive services, certificate validation issues, or other time-based attacks. Authentication controls are effectively bypassed [1][3][4].

Mitigation

The vulnerability is fixed in NTP version 4.2.8p2, released on 2015-04-07. Red Hat released RHSA-2015-1459 for affected systems, Cisco published advisory cisco-sa-20150408-ntpd, and Apple included the fix in OS X Yosemite v10.10.4. Users should upgrade to the patched version. No workaround is recommended; cryptographic network filtering may reduce risk but is not a complete solution [1][2][3][4].