CVE-2016-9311 NTP DoS Exploit Released, update your Windows server asap

A researcher released a PoC exploit for the cve-2016-9311 flaw that can cause the crash of the NTP daemon and triggers a DoS condition on Windows systems.

The NTP protocol could be exploited by hackers as an attack vector. The NTP is a networking protocol widely used for the clock synchronization purpose between systems over packet-switched, variable-latency data networks.

In the past experts reported a vulnerability in the NTP protocol that could be exploited by attackers to power massive DDoS attacks. In April 2014 the largest ever (400Gbps) Distributed Denial of Service NTP Amplification attack hits Europe servers of anti-DDoS protection firm Cloudfare.

This week, the Network Time Foundation has fixed a flaw, tracked as CVE-2016-9311, that affects NTP.org’s nptd versions prior to 4.2.8p9, except the ntp-4.3.94.

The flaw was discovered by the security researcher Magnus Stubman, it can be exploited to cause the crash of the NTP daemon and triggers a denial-of-service (DoS) condition on Windows systems.

The CVE-2016-9311 vulnerability was solved with the release of NTP 4.2.8p9, the security update addresses a total of 40 security patches, bug fixes, and improvements.

A patch was developed and sent to Stubman on 29th September. The researcher acknowledged the fix a couple of days later and then publicly disclosed the flaw.

“The vulnerability allows unauthenticated users to crash ntpd with a single malformed UDP packet, which causes a null pointer dereference,” Stubman wrote in an advisory published Monday.

“CWE-476: NULL Pointer Dereference – CVE-2016-9311

“According to NTP.org, “ntpd does not enable trap service by default. If trap service has been explicitly enabled, an attacker can send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service. Affects Windows only.” reads the Vulnerability Note VU#633847 issued by the CERT at the Software Engineering Institute at Carnegie Mellon University.

Stubman released a PoC exploit that can cause the crash of the NTP daemon and triggers a denial-of-service (DoS) condition on Windows systems. This means that theoretically everyone could crash a server with just a single specifically crafted packet.

“NTP users are strongly urged to take immediate action to ensure that their NTP daemons are not susceptible to being used in distributed denial-of-service (DDoS) attacks. Please also take this opportunity to defeat denial-of-service attacks by implementing Ingress and Egress filtering through BCP38. ntp-4.2.8p9 was released on 21 November 2016 and addresses 1 high- (Windows only), 2 medium-, 2 medium-/low-, and 5 low-severity security issues, 28 bugfixes, and contains other improvements over 4.2.8p8.

Please see the NTP Security Notice for vulnerability and mitigation details.” reads the security notice.

Giving a close look at the NTP security notice we can find another critical issue, a trap-crash vulnerability reported by the expert Matthew Van Gundy from Cisco.

“If trap service has been explicitly enabled, an attacker can send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service,” reads the advisory.

The CERT at the Software Engineering Institute at Carnegie Mellon University has also listed some vendors that could be affected by the bugs.

Administrators urge to patch their NTP implementations as soon as possible due to the availability of the PoC exploit code.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – NTP, CVE-2016-9311)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.