CVE-2015-1799

Vulnerability

The symmetric-key feature in the receive function in ntp_proto.c in ntpd (NTP 3.x and 4.x before 4.2.8p2) performs state-variable updates upon receiving certain invalid packets. This bug makes it easier for a man-in-the-middle attacker to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer [1][3].

Exploitation

An attacker who can spoof the source IP address of an NTP peer (typically requiring a network position that allows packet injection) can send crafted invalid packets to a victim ntpd. The symmetric-key association logic will process these packets and update internal state variables, eventually leading to loss of synchronization with the legitimate peer [1][3]. The attack is unauthenticated from the peer's perspective, though the attacker must know or guess the peer's IP address.

Impact

Successful exploitation results in a denial of service condition where the victim NTP client loses synchronization with its configured peer. The attacker does not gain code execution or information disclosure; the impact is limited to disruption of time synchronization [1][3]. Cisco and HPE advisories confirm the DoS impact [3][4].

Mitigation

Fixed in NTP 4.2.8p2 (released April 7, 2015). Red Hat released RHSA-2015:1459 for Red Hat Enterprise Linux [1]. Apple included updates in OS X Yosemite v10.10.4 [2]. Cisco and HPE have provided software updates for affected products [3][4]. If patching is not immediately possible, restricting NTP traffic to trusted peers via firewall rules or using authenticated symmetric-key associations with correct configuration can reduce exposure.