Cisco IOS and Cisco IOS XE ntp Subsystem Unauthorized Access Vulnerability

Summary

• A vulnerability in the ntp subsystem of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to mobilize ntp associations.
  
  The vulnerability is due to missing authorization checks on certain ntp packets. An attacker could exploit this vulnerability by ingressing malicious packets to the ntp daemon. An exploit could allow the attacker to control the time of the affected device.
  
  Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available.
  
  This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160419-ios

Affected Products

• Vulnerable Products

  The following Cisco products are vulnerable:
  

  • Cisco IOS Releases: Consult the Cisco bug ID release note for a full list of affected Cisco IOS Software trains
  • Cisco IOS XE 3.2.0 to 3.18.0S

  Products Confirmed Not Vulnerable

  Cisco IOS major release trains 12.0, 12.1, 12.2, 12.3, and 12.4 are not affected by this vulnerability. Consult the Cisco bug ID release note for a full list of affected Cisco IOS Software trains.
  

Workarounds

• Workarounds are not available; however, mitigations can be implemented to help reduce the exposure.
  

  • Use ntp authenticate to block all unauthenticated ntp associations, unless unauthenticated ntp is required.
  • Use access control lists (ACLs) to control the network ranges that can ingress ntp packets.

Fixed Software

• When considering software upgrades, customers are advised to consult the Cisco Security Advisories and Responses archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
  
  In all cases, customers should ensure that the devices to upgrade contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
  
  

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
  

Source

• This vulnerability was found during an internal security audit of the product and was introduced as part of a code change. Consult the Cisco bug ID release note for a full list of affected Cisco IOS Software trains.
  
  

URL

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160419-ios

Revision History

• Version	Description	Section	Status	Date
  1.2	Updated affected release information.	Affected Products and Source	Final	2016-September-27
  1.1	Updated information.	Affected Products	Final	2016-June-23
  1.0	Initial public release.	-	Final	2016-April-19

  Show Complete History...