NTP.org published a security advisory for thirteen vulnerabilities in NTP software and Boston University published CVE-2015-5300 on Oct 21st, 2015. These vulnerabilities may allow remote unauthenticated attackers to cause Denial(s) of Service(s), disruption of service(s) by modification of time stamps being issued by the NTP server from malicious NTP crafted packets, including maliciously crafted NTP authentication packets and disclosure of information.  This can impact DNS services, as well as certificate chains, such as those used in SSL/https communications and allow attackers to maliciously inject invalid certificates as valid which clients would accept as valid.

Junos OS

Vulnerable CVE-2015-7704 and CVE-2015-7705 http://support.ntp.org/bin/view/Main/NtpBug2901
Vulnerable CVE-2015-7853 http://support.ntp.org/bin/view/Main/NtpBug2920
Additionally, CVE-2015-7850, CVE-2015-7691, CVE-2015-7692, CVE-2015-7702, and CVE-2015-7855 affect Junos OS and are resolved in the below listed resolved releases. 

These issues are being tracked as:

PR 1132181 Junos OS
PR 1153949 Junos OS only for CVE-2015-5300
PR 1133713 ScreenOS
PR 1134729 Junos Space
PR 1144300 / 1134726 CTP OS/CTPView
PR 1134747 JSA-Series (Formerly STRM)
PR 1134760 WLAN
PR 1134789 WX OS

Junos OS
CVE-2015-7703 Not Vulnerable http://support.ntp.org/bin/view/Main/NtpBug2902
CVE-2015-7849 Not Vulnerable http://support.ntp.org/bin/view/Main/NtpBug2916
CVE-2015-7851 Not Vulnerable http://support.ntp.org/bin/view/Main/NtpBug2918
CVE-2015-7854 Not Vulnerable http://support.ntp.org/bin/view/Main/NtpBug2921
CVE-2015-7871 Not Vulnerable http://support.ntp.org/bin/view/Main/NtpBug2941
Additionally, Not Vulnerable CVE-2015-7701 CVE-2015-7848 CVE-2015-7852 

The following software releases have been updated to resolve CVE-2015-5300: Junos OS: 14.2R7 junos:15.1F5-S3 junos:15.1F6-S1 junos:15.1F7 junos:15.1R5 junos:15.1X53-D60 junos:16.1R2 junos:16.2R1, and all subsequent releases.
The following software releases have been updated to resolve the remaining issues: Junos OS 12.1X46-D45, 12.1X46-D50, 12.1X47-D35, 12.3R12, 12.3X48-D25, 13.2X51-D40, 13.3R9, 14.1R3-S9, 14.1R4-S9, 14.1R6-S2, 14.1R7, 14.1X51-D75, 14.1X53-D35, 14.2R6, 15.1F4, 15.1F5, 15.1R3, 15.1X49-D30, 15.1X53-D30, 16.1R1, and all subsequent releases.

ScreenOS
Not Vulnerable

CTP OS/CTPView
Not vulnerable to remainder of NTP.Org announced vulnerabilities.

WXOS
Not Vulnerable

JSA-Series (Formerly STRM)
CVE-2015-7848 Not Vulnerable
CVE-2015-7849 Not Vulnerable
CVE-2015-7851 Not Vulnerable
CVE-2015-7853 Not Vulnerable
CVE-2015-7854 Not Vulnerable
CVE-2015-7855 Not Vulnerable
CVE-2015-7871 Not Vulnerable

KB16765 [juniper.net] - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies.

Additional PRs and outstanding CVE's, platforms and products are still being reviewed.

This section will be updated as additional fixes for the vulnerabilities are available.

Juniper has published JSA10613 [juniper.net] and JSA10663 [juniper.net] previously to mitigate attacks and exploits against NTP.  To mitigate risk of NTP exploits, customers should read and follow the workaround sections of these JSA's.

To mitigate these exploits:

• Authenticate with only trusted higher-stratum servers e.g. if your stratum is 10, authenticate to only trusted stratum 0 - 9 servers.
• Limit the attack surface by implementing firewall filters to only accept NTP authentication messages from trusted servers.
• Some evidence exists that retrieval of time services from Non-NTP.org NTP-based servers may mitigate these currently-disclosed risks, but is not guaranteed.
• Enabling layered approaches to time services using alternate protocols such as PTPv2 (Precision Time Protocol v2) with intrusion detection systems and firewall filters externally and gatewaying PTP to NTP-required services internally may potentially mitigate risk, but is not guaranteed.

2015-10-23: Initial publication
2015-10-30: Updated current research for known non-vulnerable and vulnerable CVE's, additional PR details added.
2015-11-02: Added Boston University CVE-2015-5300 detail.
2015-11-04: Added ScreenOS not vulnerable detail.
2015-11-13: Added WXOS not vulnerable detail.
2015-11-25: Updated investigation for CTPOS/CTPView. 2 of 13 NTP.Org vulnerabilities are applicable.  Boston University CVE-2015-5300 still under investigation.
2015-11-28: CTPOS/CTPView is vulnerable to CVE-2015-5300.
2016-03-16: Updated JSA-Series (Formerly STRM) problem, solution and workaround sections with most recent details.  Boston University CVE-2015-5300 still under investigation.
2023-05-12: Added additional CVE details for Junos OS, updated CVSS from 3.0 to 3.1 for heading.
 

• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• NTP.ORG October 2015 NTP Security Vulnerability Announcement (Medium)
• CVE-2015-7871 NAK to the Future: Symmetric association authentication bypass via crypto-NAK (Cisco ASIG)
• CVE-2015-7855 decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (IDA)
• CVE-2015-7854 Password Length Memory Corruption Vulnerability. (Cisco TALOS)
• CVE-2015-7853 Invalid length data provided by a custom refclock driver could cause a buffer overflow. (Cisco TALOS)
• CVE-2015-7852 ntpq atoascii() Memory Corruption Vulnerability. (Cisco TALOS)
• CVE-2015-7851 saveconfig Directory Traversal Vulnerability. (OpenVMS) (Cisco TALOS)
• CVE-2015-7850 remote config logfile-keyfile. (Cisco TALOS)
• CVE-2015-7849 trusted key use-after-free. (Cisco TALOS)
• CVE-2015-7848 mode 7 loop counter underrun. (Cisco TALOS)
• CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC. (Tenable)
• CVE-2015-7703 configuration directives "pidfile" and "driftfile" should only be allowed locally. (RedHat)
• CVE-2015-7704 Clients that receive a KoD should validate the origin timestamp field. (Boston University)
• CVE-2015-7705 Clients that receive a KoD should validate the origin timestamp field. (Boston University)
• CVE-2015-7691 Incomplete autokey data packet length checks. (Tenable)
• CVE-2015-7692 Incomplete autokey data packet length checks. (Tenable)
• CVE-2015-7702 Incomplete autokey data packet length checks. (Tenable)
• CVE-2015-5300 Timeshifting by Rebooting a.k.a. small-step-big-step attack