CVE-2016-1551

Vulnerability

ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 treats reference clocks as peers and stores them in the same structure. Any packet with a source IP address of a reference clock (e.g., 127.127.1.1) that reaches the receive() function will match that reference clock's peer record and be treated as a trusted peer [2]. The vulnerability is exposed on systems that lack martian packet filtering, which would normally block packets claiming to be from loopback addresses arriving over physical network interfaces [1].

Exploitation

An attacker with network access can send crafted NTP packets with a spoofed source IP address of a configured reference clock (e.g., 127.127.x.x). No authentication is required. Because many reference clock drivers set their origin values to zero, it is trivial to control the target system's time [2]. The attack succeeds only if the target operating system does not filter martian packets (packets from 127.0.0.0/8 arriving on external interfaces) [1][2].

Impact

A successful attacker can manipulate the system's time, affecting time-sensitive protocols, certificate validation, and logging. The CVSS v3 score is 3.7 (Low) with integrity impact only [2]. The attacker gains the ability to control the time of the target system, which can be leveraged for further attacks [1][2].

Mitigation

Modern operating systems typically implement martian packet filtering, which mitigates this vulnerability [2]. For systems that cannot rely on OS-level filtering, additional firewall rules can block packets from 127.0.0.0/8 arriving on external interfaces [2]. FreeBSD is not affected [1]. Gentoo recommends upgrading to >=net-misc/ntp-4.2.8_p8 [3]. No specific NTP patch was released; the fix relies on OS or firewall filtering [2][3].