CVE-2016-7433

Vulnerability

NTP versions before 4.2.8p9 do not include the peer dispersion when calculating the root distance during initial synchronization [1][4]. This flaw causes the synchronization algorithm to overestimate the root distance, leading to inaccurate time adjustments. The issue is present in all NTP releases prior to 4.2.8p9 [2].

Exploitation

An attacker with network access can send crafted NTP packets to a vulnerable client or server, exploiting the flawed root distance computation. The exact vectors are not publicly disclosed, but the vulnerability can be triggered without authentication [4]. Exploitation likely requires the attacker to be on the network path or to control a malicious NTP server.

Impact

Successful exploitation can degrade time synchronization accuracy, potentially causing clients to reject valid time sources or select incorrect servers. This may lead to incorrect system time, denial of service, or unspecified impacts on time-sensitive protocols [4]. The severity is medium with a CVSS v3 base score of 5.3.

Mitigation

Upgrade to NTP 4.2.8p9 or later, released on November 21, 2016 [2]. Patches are available from Red Hat (RHEL 6 and 7) [1] and FreeBSD (all supported versions) [4]. No workarounds have been published.