CVE-2015-1798

What it actually does

The symmetric-key authentication check in ntpd receive function accepts packets when the MAC field length is zero, allowing unauthenticated spoofed NTP packets to be processed as valid.

Why it matters to the business

Attackers can inject false time data into NTP infrastructure, causing desynchronized clocks that disrupt logging accuracy, certificate validation, scheduled jobs, and security controls across the environment.

How an attack unfolds

A man-in-the-middle attacker intercepts legitimate NTP exchanges and replies with crafted packets that omit the MAC entirely; because the length check precedes MAC validation, the packets are accepted and time updates are applied without authentication.

How to fix it

Upgrade all NTP installations to version 4.2.8p2 or newer; disable symmetric-key mode if not required; enforce network segmentation and NTP authentication where feasible.

How to confirm the fix worked

Verify deployed ntpd version is 4.2.8p2 or later; perform packet capture tests confirming that zero-length MAC packets are rejected; review configuration for required authentication settings.

Typical attack path

1. Establish network position between NTP client and server
2. Capture outbound NTP requests
3. Craft and transmit spoofed responses with zero-length MAC field
4. Induce acceptance of falsified time data
5. Leverage resulting clock skew for follow-on attacks

How to detect it

Review NTP packet captures and logs for responses containing a zero-length MAC field; correlate with sudden unexpected time changes on affected hosts; examine ntpd debug or statistics logs for authentication bypass indicators.

• ntp_proto.c receive function processing zero-length MAC
• ntpd packets with MAC length field set to 0 yet accepted
• sudden unscheduled time adjustments in ntpd statistics

What your security team should do

• Prioritize upgrade of all NTP daemons to 4.2.8p2 or later
• Audit NTP configurations for symmetric-key usage and replace with modern alternatives where possible
• Implement network controls to limit NTP traffic to trusted sources
• Monitor system clocks for unexpected drift or jumps