NTP users are strongly urged to take immediate action to ensure that their NTP daemons are not susceptible to being used in distributed denial-of-service (DDoS) attacks. Please also take this opportunity to defeat denial-of-service attacks by implementing Ingress and Egress filtering through BCP38.
ntp-4.2.8p15
was released on 23 June 2020. It addresses 1 medium-severity security issue in ntpd, and provides 13 non-security bugfixes over 4.2.8p13.
Please see the NTP Security Notice for vulnerability and mitigation details.Are you using Autokey in production? If so, please contact Harlan - he's got some questions for you.
ntpd
is always started with the -g
option, which is common and against long-standing recommendation, and if at the moment ntpd
is restarted an attacker can immediately respond to enough requests from enough sources trusted by the target, which is difficult and not common, there is a window of opportunity where the attacker can cause ntpd
to set the time to an arbitrary value. Similarly, if an attacker is able to respond to enough requests from enough sources trusted by the target, the attacker can cause ntpd
to abort and restart, at which point it can tell the target to set the time to an arbitrary value if and only if ntpd
was re-started against long-standing recommendation with the -g
flag, or if ntpd
was not given the -g
flag, the attacker can move the target system's time by at most 900 seconds' time per attack.
ntpd
to get time from multiple sources.
-g
option to ntpd
in cold-start situations.
ntpd
instances.
NOTE WELL: The-- SueGraves - 2016-01-08-g
flag disables the limit check on thepanic_gate
inntpd
, which is 900 seconds by default. The bug identified by the researchers at Boston University is that thepanic_gate
check was only re-enabled after the first change to the system clock that was greater than 128 milliseconds, by default. The correct behavior is that thepanic_gate
check should be re-enabled after any initial time correction. If an attacker is able to inject consistent but erroneous time responses to your systems via the network or "over the air", perhaps by spoofing radio, cellphone, or navigation satellite transmissions, they are in a great position to affect your system's clock. There comes a point where your very best defenses include:
- Configure
ntpd
to get time from multiple sources.- Monitor your
ntpd
instances.