Researchers tag new brace of bugs in NTP, but they're fixable

Back in January, Cisco dropped a bunch of NTP (network time protocol) patches; now, it's emerged that the research behind that round of fixes also turned up other bugs that haven't yet been fixed.

This week, Ciscoans Matt Gundy and Jonathan Gardner teamed up with Boston University's Aanchal Malhotra, Mayank Varia, Haydn Kennedy and Sharon Goldberg to show off a bunch of possible attacks against NTP's datagram protocol.

The bad news: the group reckons millions of IP addresses are currently vulnerable.

The good news? The protocol is fixable, and the researchers urge the IETF to adopt a cryptographic model for better client/server NTP protocols.

Fooling around with NTP is a handy attack vector, since you can spoil cryptographic calculations, “roll back time”, or cause denial-of-service attacks.

A lot of attacks against NTP are man-in-the-middle attacks; what the Cisco / Boston University demonstrate are three off-path attacks (one of which, CVE-2015-8138, was fixed by Cisco in January, and has also been fixed in later versions of the NTP daemon).

The vulnerabilities exist because RFC 5905, which defines NTP, has a fundamental problem: “client/server mode and symmetric mode have conflicting security requirements; meanwhile, RFC5905 suggests identical processing for incoming packets of both modes”.

Vulnerabilities discussed in the paper include:

However, because these are protocol vulnerabilities, the researchers fixing NTP is more important. They propose replacing the current model with one that uses more cryptography.

While the 'net's druids contemplate that proposal, the group reminds sysadmins they should “Finally, we suggest the firewalls and ntpd clients block all incoming NTP control queries from unwanted IPs”. ®