NTP Service and Monlist Vulnerability

【NTP Monlist Vulnerability Introduction】

NTP is short for Network Time Protocol. It is one of the standards for time synchronization in the Internet. Its purpose is to synchronize the clock of the computer to the international standard time, and the machine connected to the Internet will calibrate the time through the protocol.

NTP includes a monlist function, also known as MON_GETLIST, which is mainly used to monitor NTP servers. The monlist (ntp_request.c) function has a security vulnerability. After the NTP server responds to the monlist, it returns the IPs of the last 600 clients that have performed time synchronization with the NTP server; the response packages are split every 6 IPs, and there will be up to 100 response packets eventually. A remote attacker may exploit the vulnerability to forge a REQ_MON_GETLIST or REQ_MON_GETLIST_1 request to amplify traffic and perform a service denial attack on the target system.

With this feature and combining with that the NTP protocol is the connectionless UDP protocol, the attacker forges the attacked target IP to initiate Monlist query commands to multiple NTP servers, and multiple NTP servers will send a large number of packages containing newly synchronized client IPs to the attacked target IP, occupy the target IP bandwidth resource, therefore cause the reflective distributed service denial attack.

The attack process is as follows:

The attacker constructs the monlist command and sets the source address as the IP address of the attacked target.
The attacker sends the monlist command constructed in step 1 to the NTP servers open in the network.
The NTP servers receive the monlist command, perform the operations, and send responses to the source address (i.e. the attacked IP) in the monlist command package.
The target address receives a large number of responses from the NTP servers for no reason, the network bandwidth is blocked, and the normal processing processes are affected.

【Fix Methods】

The NTP service administrator can fix the vulnerability by upgrading the version or modifying the configuration.

1. Upgrade version: For versions after the ntpd-4.2.7p26 version, the "monlist" feature has been disabled, replaced by the "mrulist" feature, which uses mode6 to control packets and implements a handshaking process to block the magnified attack from the third-party machine. Users are advised to upgrade the NTP server to version 4.2.7p26 or higher.

http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-dev/ntp-dev-4.2.7p26.tar.gz

http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-dev/ntp-dev-4.2.7p421.tar.gz

2. Modify configuration: For versions prior to 4.2.7, the disable monitor option may be added to the ntp.conf file to disable the monlist function. restrict ... noquery or restrict ... ignore can also be used to limit the source address of the ntpd service response.

(1) Operating method 1: echo "disable monitor" >> /etc/ntp.conf

(2) Operating method 2: Edit /etc/ntp.conf to add the noquery limit

restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

Note: After the configuration is modified, the NTP service can only take effect after reboot.

The target machine attacked by NTP: You can defend by the ACL rules of the network layer, or use the anti-DDoS system for traffic cleaning.

【Verification Method】

1.ntpdc -n -c monlist ntp_server-IP 
2.nmap -sU -pU:123 -Pn -n --script=ntp-monlist NTP_Server_IP

【NTP Official Vulnerability Announcement Instruction】

http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities

NTP Service and Monlist Vulnerability

Products

开始与售前顾问沟通

可直接拨打电话 400-098-8505转1