Matthew Van Gundy

**Name of the Vulnerable Software and Affected Versions** ntpd version 4.2.8p9 **Description** An issue exists in the origin timestamp check functionality, where a specially crafted unauthenticated network packet can reset the expected origin timestamp for target peers. This causes legitimate replies from targeted peers to fail the origin timestamp check, resulting in a denial of service condition. **Recommendations** For ntpd version 4.2.8p9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NTP versions prior to 4.2.8p9 **Description** The issue allows remote attackers to cause a denial of service, resulting in a crash due to a NULL pointer dereference when the trap service is enabled. This can be achieved by sending specially crafted packets to the affected system. **Recommendations** For versions prior to 4.2.8p9, update to version 4.2.8p9 or later to resolve the issue. As a temporary workaround, consider disabling the trap service until a patch is available.

**Name of the Vulnerable Software and Affected Versions** NTP versions prior to 4.2.8p9 **Description** The issue allows remote attackers to set or unset traps via a crafted control mode packet, which can lead to a denial of service caused by a NULL pointer dereference when the trap service has been enabled. By sending specially crafted packets, a remote attacker could exploit this to cause the application to crash. **Recommendations** For versions prior to 4.2.8p9, update to version 4.2.8p9 or later to resolve the issue. As a temporary workaround, consider disabling the trap service to minimize the risk of exploitation. Restrict access to the control mode functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NTP versions prior to 4.2.8p9 **Description** The issue allows remote attackers to cause a denial of service (reject broadcast mode packets) via a crafted broadcast mode packet. It is also caused by a NULL pointer dereference when trap service has been enabled, allowing a remote attacker to exploit this vulnerability to cause the application to crash. Multiple vulnerabilities could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or modify the time being advertised by a device acting as a Network Time Protocol (NTP) server. **Recommendations** For NTP versions prior to 4.2.8p9, update to version 4.2.8p9 or later to resolve the issue. As a temporary workaround, consider disabling the trap service to minimize the risk of exploitation. Restrict access to the broadcast mode to prevent crafted packets from causing a denial of service.

**Name of the Vulnerable Software and Affected Versions** NTP versions prior to 4.2.8p9 **Description** The issue allows remote attackers to cause a denial of service, potentially by exploiting the `poll interval` in a broadcast packet or through a NULL pointer dereference when the trap service is enabled. This could be achieved by sending specially crafted packets. Multiple vulnerabilities in the NTP daemon package could allow an unauthenticated, remote attacker to cause a denial of service condition or modify the time being advertised by a device acting as an NTP server. **Recommendations** For NTP versions prior to 4.2.8p9, update to version 4.2.8p9 or later to resolve the issue. As a temporary workaround, consider disabling the trap service to minimize the risk of exploitation. Restrict access to broadcast mode packets to prevent denial of service attacks. Avoid using the `poll interval` in broadcast packets until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** ntp versions 4.2.8p4 NTPSec version a5fb34b9cc89b92a8fef2f459004865c93bb7f92 **Description** An issue exists in the message authentication functionality of libntp, allowing an attacker to send crafted messages in an attempt to recover the `message digest key`. This could potentially be exploited by sending a series of crafted messages. **Recommendations** For ntp version 4.2.8p4, consider updating to a version where this issue is resolved, as the current version is affected. For NTPSec version a5fb34b9cc89b92a8fef2f459004865c93bb7f92, restrict access to the `message authentication` functionality until a patch is available. As a temporary workaround, consider disabling the `message authentication` functionality in libntp until a patch is available.

**Name of the Vulnerable Software and Affected Versions** NTP versions 4.2.8p4 and earlier NTPSec version a5fb34b9cc89b92a8fef2f459004865c93bb7f92 **Description** An off-path attacker can cause a preemptible client association to be demobilized by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This issue persists even when authentication is enabled. **Recommendations** For NTP versions 4.2.8p4 and earlier, consider disabling the preemptible client association feature until a patch is available. For NTPSec version a5fb34b9cc89b92a8fef2f459004865c93bb7f92, restrict access to the crypto NAK packet handling mechanism to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ntpd versions prior to 4.2.8p4 NTPsec versions prior to a5fb34b9cc89b92a8fef2f459004865c93bb7f92 **Description** A malicious authenticated peer can exploit an issue in the clock selection algorithm to modify a victim's clock. The issue is related to the handling of ephemeral associations, allowing an attacker to create multiple associations and influence the clock selection. This can potentially impact the integrity of data. **Recommendations** For ntpd versions prior to 4.2.8p4, update to a version later than 4.2.8p4 to resolve the issue. For NTPsec versions prior to a5fb34b9cc89b92a8fef2f459004865c93bb7f92, update to a version later than a5fb34b9cc89b92a8fef2f459004865c93bb7f92 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** NTP versions prior to 4.2.8p7 Cisco IOS (affected versions not specified) **Description** The issue allows remote attackers to obtain origin timestamps and then impersonate peers. There is also a vulnerability in Cisco IOS, but details are not provided. **Recommendations** For NTP versions prior to 4.2.8p7, update to version 4.2.8p7 or later to resolve the issue. For Cisco IOS, at the moment, there is no information about a newer version that contains a fix for this vulnerability.