Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: June 2016
Multiple Cisco products incorporate a version of the Network Time Protocol daemon (ntpd) package. Versions of this package are affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or modify the time being advertised by a device acting as a Network Time Protocol (NTP) server.On June 2, 2016, the NTP Consortium of the Network Time Foundation released a security notice that details 5 issues regarding DoS vulnerabilities and logic issues that may allow an attacker to shift a system's time.
The new vulnerabilities disclosed in this document are as follows:
- Network Time Protocol CRYPTO-NAK Denial of Service Vulnerability
- Network Time Protocol Bad Authentication Demobilizes Ephemeral Associations Vulnerability
- Network Time Protocol Processing Spoofed Server Packets Vulnerability
- Network Time Protocol Autokey Association Reset Vulnerability
- Network Time Protocol Broadcast Interleave Vulnerability
Cisco will release software updates that address these vulnerabilities.
Workarounds that address one or more of these vulnerabilities may be available and will be documented in the Cisco bug for each affected product.
This advisory is available at the following link:
http://ift.tt/1Pa1MGc
Multiple Cisco products incorporate a version of the Network Time Protocol daemon (ntpd) package. Versions of this package are affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or modify the time being advertised by a device acting as a Network Time Protocol (NTP) server.On June 2, 2016, the NTP Consortium of the Network Time Foundation released a security notice that details 5 issues regarding DoS vulnerabilities and logic issues that may allow an attacker to shift a system's time.
The new vulnerabilities disclosed in this document are as follows:
- Network Time Protocol CRYPTO-NAK Denial of Service Vulnerability
- Network Time Protocol Bad Authentication Demobilizes Ephemeral Associations Vulnerability
- Network Time Protocol Processing Spoofed Server Packets Vulnerability
- Network Time Protocol Autokey Association Reset Vulnerability
- Network Time Protocol Broadcast Interleave Vulnerability
Cisco will release software updates that address these vulnerabilities.
Workarounds that address one or more of these vulnerabilities may be available and will be documented in the Cisco bug for each affected product.
This advisory is available at the following link:
http://ift.tt/1Pa1MGc
Security Impact Rating: High
CVE: CVE-2016-4953,CVE-2016-4954,CVE-2016-4955,CVE-2016-4956,CVE-2016-4957
from Cisco Security Advisory http://ift.tt/1Pa1MGc