As the ntp.conf file on a linux server can be setup to allow the system to act as both a client to the public servers and a time server source for local systems am I correct in assuming that it (the "server") also needs the updated ntpd package? All of the documentation on this CVE specifically talks about "clients".

2 Answers 2


The vulnerability is about being able to manipulate the polling rate, something that is only relevant to a client. https://bugzilla.redhat.com/show_bug.cgi?id=1271070

CVE-2015-7705 is the CVE for the bug that affects the server (DOS).

The full technical discussion of the bugs is found here: http://bugs.ntp.org/show_bug.cgi?id=2901

In answer to the "stratum" question, you have to look at the definition of the KoD messages:

According to the NTP specification RFC 1305, if the Stratum field in the NTP header is 1, indicating a primary server, the Reference Identifier field contains an ASCII string identifying the particular reference clock type. However, in RFC 1305 nothing is said about the Reference Identifier field if the Stratum field is 0, which is called out as "unspecified". However, if the Stratum field is 0, the Reference Identifier field can be used to convey messages useful for
status reporting and access control. In NTPv4 and SNTPv4, packets of this kind are called Kiss-o'-Death (KoD) packets, and the ASCII messages they convey are called kiss codes. The KoD packets got their name because an early use was to tell clients to stop sending
packets that violate server access controls.

RFC 4330

  • 1
    However a server acts as a "client" when it syncs with the stratum servers, or does it still not apply?
    – user53029
    Commented Oct 30, 2015 at 15:38
  • Hmmm...interesting. So if I am understanding that correctly, if the ntp headers in the stratum field are 0, then 7704 could technically apply to servers as well. Is that your interpretation as well?
    – user53029
    Commented Oct 30, 2015 at 18:07

It can indirectly affect servers, since most NTP daemons act as both client and server at the same time. So for instance: Suppose a stratum 2 (that is a client of stratum 1 servers) gets spoofed KoDs for a its stratum 1 servers. The stratum 2 host will stop syncing to its servers. Then, the stratum 3 clients that depend on the stratum 2 host will also be impacted, since the stratum 2 is no longer synchronized.

So the KoD attack is on clients. But clients also act as servers in NTP, so it affects servers as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .