Cisco security researchers have identified multiple security vulnerabilities in the Network Time Protocol (NTP) used in Linux, Mac, and BSD OS distributions.
The vulnerabilities were announced on the official NTP website on October 21, and for fans of ...coincidences, the date coincides with the date that Michael Fox traveled through time in the famous film "Back to the Future 2".
Surprisingly, one of the 8 vulnerabilities identified in the NTP protocol allows attackers to take control of the clock of any vulnerable system, offering their victims the illusion of time travel!
The vulnerabilities were found in the Network Time Protocol daemon (ntpd), which is used to set timing between computer networks.
Among the vulnerabilities identified are an authentication bypass bug that allows the system's local time to be changed, multiple memory corruption vulnerabilities that expose the protocol to buffer overflow or use-after-free attacks, security holes that could lead to DoS by causing the daemon to crash or enter an infinite loop, as well as two directory traversal and file overwrite vulnerabilities that allowed attackers to replace ntpd configs.
All versions between NTP 4.2.5p186 and 4.2.8p3 are vulnerable, but the good news is that the NTP developers have released a new version of the protocol that fixes the above issues.
In addition to the vulnerabilities reported by Cisco researchers, five more vulnerabilities, of medium or low severity, were identified, which were reported by security experts from Red Hat, IDA, Boston University, and Tenable Networks and were also fixed in the new version of the protocol.
