NTP CVE-2015-7704/7705: Forged KoD Messages DoS Vulnerability Analysis

Key Information Vulnerability Overview Vulnerability ID: NTP BUG 2901 Title: Clients that receive a KoD should validate the origin timestamp field Last Updated: April 22, 2024 18:49 UTC Fixed Version: 4.2.8p4, released on October 21, 2015 CVEs: CVE-2015-7704, CVE-2015-7705 Affected Versions: All ntp-4 versions except 4.2.8p4, and 4.3.0 versions except 4.3.77. Fixed In: Version 4.2.8p4 CVSS2 Score: Up to 4.3–5.0 Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial Description The ntpd client processes forged KoD (Kiss-of-Death) messages sent by attackers, causing the client to delay or stop querying time servers for time updates. Additionally, attackers can forge packets from the target and send them to the server, triggering the server’s KoD rate-limiting mechanism to send KoD responses back to the target machine, attempting to reduce incoming packets, or potentially triggering firewall blocking on the server side for packets originating from the target machine. For both attacks to succeed, the attacker must know which server the target is communicating with. The attacker can be located anywhere on the Internet and can frequently discover the target’s time source by sending time queries to the target. Mitigation Implement: BCP-38. Upgrade to: Version 4.2.8p4 or later. If unable to upgrade: Restrict the IP addresses that can query ntpd to discover its server, and limit which IPs can query the system’s time. This mitigation is operationally heavy. Monitor your: ntpd instances. Note: Version 4.2.8p4 prevents the first type of attack. For the second attack, we can only issue warnings when it occurs. Credit This vulnerability was discovered by Aanchal Malhotra, Issac E. Cohen, and Sharon Goldberg from Boston University. Timeline October 21, 2015: Public release. October 6, 2015: Early access program released for Premier and Partner Institutional Members. August 26, 2015: Notification to Institutional Members regarding bugs 1593, 1774, 2382, 2899, and 2902. August 20, 2015: Initial notification for bug 2902; analysis began. August 11, 2015: Initial notification for bug 2899; analysis began.

Goal Reached Thanks to every supporter — we hit 100%!

NTP CVE-2015-7704/7705: Forged KoD Messages DoS Vulnerability Analysis