CVE-2015-7973

What it actually does

In NTP broadcast mode, unauthenticated replay of sniffed packets bypasses intended origin validation, allowing an attacker to inject forged time updates that alter client clocks without cryptographic verification.

Why it matters to the business

Disrupted time synchronization can cascade into failed certificate validations, inconsistent logging, and operational errors across dependent services; the issue remains exploitable in unpatched broadcast deployments despite low observed exploitation rates and no ransomware association.

How an attack unfolds

An attacker positioned on the same network segment captures legitimate NTP broadcast packets, then replays them later to victim clients configured in broadcast mode, causing the clients to accept stale time data as fresh.

How to fix it

Upgrade affected NTP deployments to version 4.2.8p6 or 4.3.90 and newer; for gatekeeper-3.14 (Chainguard) and gatekeeper-3.14 (Wolfi) environments, apply the fixed package versions 3.14.0-r5 or later. Disable broadcast mode where feasible and enforce authenticated modes such as symmetric keys or Autokey.

How to confirm the fix worked

Verify NTP daemon versions meet or exceed the fixed releases, review configuration files for broadcast directives, and test replay resistance using controlled packet capture and retransmission in a lab environment.

Typical attack path

1. Identify NTP clients operating in broadcast mode via passive traffic observation
2. Capture valid broadcast packets using network sniffing tools
3. Replay captured packets to targeted clients at a later time
4. Observe resulting clock adjustments or service impacts on victims

How to detect it

Review NTP daemon logs and network flow data for repeated identical broadcast packets originating from unexpected sources or timestamps that do not advance; correlate with client clock drift alerts.

What your security team should do

• Immediately inventory all systems using NTP broadcast mode and schedule upgrades to the specified fixed versions
• Migrate broadcast clients to authenticated NTP associations to eliminate the replay vector
• Monitor EPSS and KEV updates for any future increase in observed exploitation