Stack out-of-bounds read in NTPsec - CVE-2019-6444

Vulnerability details

The vulnerability allows a remote authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to attacker-controlled data is dereferenced by ntohl() in ntpd. A remote attacker can trigger stack-based buffer over-read in process_control() in ntp_control.c perform a denial of service attack.

Affected software

How to mitigate CVE-2019-6444

Links to Public Exploits and PoC-codes

• Exploit #6142 - NTPsec 1.1.2 - 'ntp_control' Out-of-Bounds Read (PoC) (June 17, 2021)

External References

• https://dumpco.re/blog/ntpsec-bugs
• https://dumpco.re/bugs/ntpsec-oobread2
• https://github.com/ntpsec/ntpsec/blob/NTPsec_1_1_3/NEWS
• https://www.exploit-db.com/exploits/46176/

Related Security Bulletins

• Multiple vulnerabilities in NTPsec
• OpenSUSE Linux update for ntpsec
• Stack out-of-bounds read in ntpsec (Alpine package)