Important Information about NTP Vulnerabilities (CVE-2016-4957, CVE-2016-4953, CVE-2016-4954, CVE-2016-4955, and CVE-2016-4956)
Publish Time: 2016-06-08 00:00:00 UTC+8
Last Updated: UTC+8
- Status
- Resolved
Description
Multiple security vulnerabilities regarding the NTP module were announced on June 2, 2016 (CVE-2016-4957, CVE-2016-4953, CVE-2016-4954, CVE-2016-4955, and CVE-2016-4956).
Results of the initial investigation showed that the flaw of NTP could cause ntpd to crash and can be used to amplify distributed denial-of-service (DDoS) attacks. Even though the impact caused by these vulnerabilities on Synology NAS is limited, Synology is now working on DSM 6.0 updates to address these vulnerabilities for precautionary purposes.
A Synology NAS that is not synchronized with an NTP server or that has NTP service disabled will not be affected.
Mitigation
Before the update is released, the concerned users may refer to the following steps to mitigate the impact of this vulnerability:
- Go to Control Panel > Regional Option > Time.
- Under Time Setting, select “Manually” rather than “Synchronize with NTP server”.
- Switch to the NTP Service tab and make sure that the “Enable NTP Service” option is NOT ticked.
Update availability
Synology is working on the update addressing these vulnerabilities and will release the patch for DSM 6.0 shortly.