Out-of-bounds write in NTPsec - CVE-2019-6442

Vulnerability identifier: #VU17181

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-6442

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The weakness exists due to the affected software allows one byte to be written out of bounds in the ntpd daemon, related to the config_remotely function in the ntp_config.c source code file, the yyparse function in the ntp_parser.tab.c source code file, and the yyerror function in the ntp_parser.y source code file. A remote attacker can send a configuration request that submits malicious input, trigger ou-of-bounds write and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

NTPsec
ntpsec (Alpine package)
Opensuse

Update to version 1.1.3.

NTPsec - update to 1.1.3
ntpsec (Alpine package) - update to 1.1.3-r0

• Exploit #6140 - NTPsec 1.1.2 - 'config' (Authenticated) Out-of-Bounds Write Denial of Service (PoC) (June 17, 2021)

• https://dumpco.re/blog/ntpsec-bugs
• https://dumpco.re/bugs/ntpsec-authed-oobwrite
• https://github.com/ntpsec/ntpsec/blob/NTPsec_1_1_3/NEWS
• https://www.exploit-db.com/exploits/46178/

• Multiple vulnerabilities in NTPsec
• OpenSUSE Linux update for ntpsec
• Out-of-bounds write in ntpsec (Alpine package)