Now that you mentioned it, I was curious about this one also.
TLDR: The device is exploitable if it has NTP enabled. Note: You don't have to worry about CVE-2016-4956, if you don't have broadcast NTP clients.
If you want more details, read on:
From this referenced bug ID:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz92785
It references these as affecting:
* CVE-2016-4956: Network Time Protocol Broadcast Interleave Vulnerability
* CVE-2016-4953 - Network Time Protocol Bad Authentication Demobilizes Ephemeral Associations Vulnerability
* CVE-2016-4954 - Network Time Protocol Processing Spoofed Server Packets Vulnerability
I traced these back to ntp.org. From reading the bug info I cannot see how these are dependent upon the NTP client config, but are vulnerabilities inherent to NTP itself -- all of which seem to involve the processing of spoofed packets. There is one exception: If you weren't using broadcast clients, then NTP bug 3042 wouldn't apply, since it's specific to broadcast clients. As far as mitigations, if Network Ingress Filtering is implemented, that should cut down on spoofed packets until you can upload the protocol fix to your gear.
See links referenced below:
RFC 2827, BCP 38, Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing
https://tools.ietf.org/html/rfc2827.html
CVE-2016-4953
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4953
http://support.ntp.org/bin/view/Main/NtpBug3045
http://bugs.ntp.org/show_bug.cgi?id=3045
CVE-2016-4954:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4954
http://support.ntp.org/bin/view/Main/NtpBug3044
http://bugs.ntp.org/show_bug.cgi?id=3044
CVE-2016-4956:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4956
http://support.ntp.org/bin/view/Main/NtpBug3042
http://bugs.ntp.org/show_bug.cgi?id=3042
