CVE-2018-7170

Name of the Vulnerable Software and Affected Versions ntp versions 4.2.x through 4.2.8p6 ntp versions 4.3.x through 4.3.91

Description The issue is related to errors in key management in the ntpd implementation of the NTP protocol, allowing a remote attacker to impact the integrity of protected information. Specifically, authenticated users who know the private symmetric key can create multiple ephemeral associations to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This is due to an incomplete fix for a previous issue.

Recommendations For ntp versions 4.2.x through 4.2.8p6, update to version 4.2.8p7 or later. For ntp versions 4.3.x through 4.3.91, update to version 4.3.92 or later. As a temporary workaround, consider restricting access to the private symmetric key to prevent authenticated users from creating multiple ephemeral associations.