3528 matches found
DEBIAN-CVE-2019-6445
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntpcontrol.c, related to ctlgetitem...
Stack overflow
An issue was discovered in NTPsec before 1.1.3. processcontrol in ntpcontrol.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl in ntpd...
CVE-2019-6442
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to configremotely in ntpconfig.c, yyparse in ntpparser.tab.c, and yyerror in ntpparser.y...
Design/Logic Flaw
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to configremotely in ntpconfig.c, yyparse in ntpparser.tab.c, and yyerror in ntpparser.y...
Stack overflow
An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctlgetitem, there is a stack-based buffer over-read in readsysvars in ntpcontrol.c in ntpd...
CVE-2019-6443
CVE-2019-6443 affects NTPsec ntpd prior to v1.1.3. The issue is a stack-based buffer over-read in the ctl_getitem function within ntp_control.c read_sysvars, enabling a remote attacker to cause a denial of service. Public details reference a PoC/exploits for 1.1.2 and corroborating advisories sho...
CVE-2019-6442
CVE-2019-6442 affects the ntpsec project prior to version 1.1.3. An authenticated attacker can trigger an out-of-bounds write in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in ntp_parser.y. The issue is addressed by upg...
CVE-2019-6444
CVE-2019-6444 affects NTPsec prior to 1.1.3. The issue is a stack-based buffer over-read in ntp_control.c::process_control(), where attacker-controlled data is dereferenced by ntohl() in ntpd. Acts as a remote-network issue; exploitation can lead to information leakage and potential denial of ser...
NTPsec Null Pointer Dereference Vulnerability
NTPsec is an implementation of the Network Time Protocol. A null pointer dereference vulnerability exists in the ntpcontrol.c file in versions of NTPsec prior to 1.1.3, which can be exploited by an attacker to cause a denial of service...
NTPsec 1.1.2 - 'ntp_control' Out-of-Bounds Read (PoC)
!/usr/bin/env python Exploit Title: ntpsec 1.1.2 OOB read Proof of concept Bug Discovery: Magnus Klaaborg Stubman @magnusstubman Exploit Author: Magnus Klaaborg Stubman @magnusstubman Website: https://dumpco.re/bugs/ntpsec-oobread2 Vendor Homepage: https://ntpsec.org/ Software Link:...
Denial Of Service (DoS)
ntp is vulnerable to denial of service. A stack-based buffer overflow occurs in ntpq and ntpdc resulting in a crash or possibly arbitary code execution, when an attacker passes a long string as the argument for an IPv4 or IPv5 command-line parameter...
Denial Of Service (DoS)
ntp is vulnerable to denial of service. A vulnerability in the parsing of packets from the /dev/datum device allows a malicious device to send malicious messages that causes ntpd to crash...
Denial Of Service (DoS)
ntp is vulnerable to denial of service DoS attacks. The vulnerability exists as NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service prevent responses from the...
Denial Of Service (DoS)
ntp is vulnerable to denial of service DoS attacks. The vulnerability exists as the logconfigcommand function in ntpparser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service ntpd crash via crafted logconfig commands...
Denial Of Service (DoS)
ntp is vulnerable to denial of service. It was found that when NTP was configured in broadcast mode, a remote attacker could broadcast packets with bad authentication to all clients. The clients, upon receiving the malformed packets, would break the association with the broadcast server, causing...
Validation Bypass
ntp is vulnerable to validation bypass. It was discovered that ntpd as a client did not correctly check the originate timestamp in received packets. A remote attacker could use this flaw to send a crafted packet to an ntpd client that would effectively disable synchronization with the server, or...
Denial Of Service (DoS)
ntp is vulnerable to denial of service. It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that would increase the client's polling interval value, and...
Denial Of Service (DoS)
ntp is vulnerable to denial of service DoS attacks. The vulnerability exists as the panicgate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time...
Denial Of Service (DoS)
ntp is vulnerable to denial of service DoS attacks. The vulnerability exists as a stack-based buffer overflow was found in the way the NTP autokey protocol was implemented. When an NTP client decrypted a secret received from an NTP server, it could cause that client to crash...
Brute-force Attack
ntp is vulnerable to brute-force attacks. The vulnerability exists as the configauth function in ntpd, when the authkey is not configured, improperly generates a key that allows remote attacker to defeat the cryptographic protection mechanisms via brute-force...