NTPsec NTS extension field parsing flaw crashes ntpd and can set client time
Time-sync programs can be crashed or have their clock changed.
Summary
An out-of-bounds read and write in NTS client extension field parsing lets a remote attacker crash ntpd or bypass NTS authentication to set the client's time. NTPsec versions before 1.2.5 are affected.
Affected when
- NTPsec client using NTS
- NTPsec before 1.2.5
What to do
Update to NTPsec 1.2.5 or later. Versions 1.2.4 and later already fix the related NTS-KE flaw.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen