Ntpsec
Monthly
Remote denial of service in NTPsec ntpd 1.1.4 through 1.2.5 lets an unauthenticated network attacker crash the daemon by sending a crafted NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length, but only on instances where Network Time Security is actually configured and enabled. The out-of-bounds read terminates the process, producing a pure availability impact with no confidentiality or integrity loss, and no public exploit code has been identified at time of analysis. The NTS deployment prerequisite - not the default for many NTP installations - substantially bounds the exposed population, making this a genuine but limited availability risk.
Denial of service in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote unauthenticated attacker to terminate the daemon by sending an NTS request that contains an excessive number of NTS Cookie Placeholder extension fields. The flaw is only reachable when Network Time Security is enabled and the daemon is accepting NTS requests; deployments without NTS configured are not exposed. No CISA KEV entry was identified, and no public exploit was identified at time of analysis; the assessed impact is availability-only with no confidentiality or integrity effect.
Arbitrary shell command execution in gpsd's gpsprof profiling tool (through release-3.27.5) allows an attacker who controls a GPS device's subtype value to run commands as the user rendering the plot. The subtype string - taken from a DEVICES JSON log entry or an NMEA PGRMT sentence - is embedded into a generated gnuplot program's `set title` statement with only double quotes escaped, so backtick payloads execute when the victim renders the plot via the gpsprof/gnuplot workflow. This was reported by VulnCheck; a vendor fix is available (fixed at commit 4c06658), and there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds read in NTPsec ntpd before 1.2.6 can crash the daemon or disclose limited memory when an attacker controls the serial data from a Motorola Oncore GPS receiver and sends a PPS Control (@@Gc) reply with an out-of-range mode byte. Only deployments built and configured with the Motorola Oncore refclock driver and attached to an Oncore-family receiver are exposed, making this a stratum-1 time-server scenario rather than a default configuration. Exploitation requires control of the receiver’s serial path (AV:P), though no authentication is needed once that access is achieved (PR:N); no public exploit code or confirmed active exploitation was identified in the available data.
Heap-based memory corruption in NTPsec ntpd before 1.2.6 affects deployments that explicitly enable the non-default JJY refclock driver in Telephone JJY mode (refclock type 40). An unauthenticated attacker with physical/local control of the Telephone JJY time source can send more than six time replies to the driver, causing heap corruption, an ntpd crash, and high integrity/availability impact; the CVSS score is 6.4 but real-world priority is low because stock configurations do not enable this region-specific driver. No public exploit code was identified at time of analysis.
Buffer overflow in NTPsec's Zyfer refclock driver crashes the ntpd daemon on affected systems running versions prior to 1.2.5. A local, low-privileged attacker with high attack complexity can trigger the CWE-120 classic buffer overflow, resulting in a denial-of-service impact limited to availability - no confidentiality or integrity exposure exists. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ntpkeygen can generate keys that ntpd fails to parse. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required.
An issue was discovered in NTPsec before 1.1.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in NTPsec before 1.1.3. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in NTPsec before 1.1.3. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in NTPsec before 1.1.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Remote denial of service in NTPsec ntpd 1.1.4 through 1.2.5 lets an unauthenticated network attacker crash the daemon by sending a crafted NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length, but only on instances where Network Time Security is actually configured and enabled. The out-of-bounds read terminates the process, producing a pure availability impact with no confidentiality or integrity loss, and no public exploit code has been identified at time of analysis. The NTS deployment prerequisite - not the default for many NTP installations - substantially bounds the exposed population, making this a genuine but limited availability risk.
Denial of service in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote unauthenticated attacker to terminate the daemon by sending an NTS request that contains an excessive number of NTS Cookie Placeholder extension fields. The flaw is only reachable when Network Time Security is enabled and the daemon is accepting NTS requests; deployments without NTS configured are not exposed. No CISA KEV entry was identified, and no public exploit was identified at time of analysis; the assessed impact is availability-only with no confidentiality or integrity effect.
Arbitrary shell command execution in gpsd's gpsprof profiling tool (through release-3.27.5) allows an attacker who controls a GPS device's subtype value to run commands as the user rendering the plot. The subtype string - taken from a DEVICES JSON log entry or an NMEA PGRMT sentence - is embedded into a generated gnuplot program's `set title` statement with only double quotes escaped, so backtick payloads execute when the victim renders the plot via the gpsprof/gnuplot workflow. This was reported by VulnCheck; a vendor fix is available (fixed at commit 4c06658), and there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds read in NTPsec ntpd before 1.2.6 can crash the daemon or disclose limited memory when an attacker controls the serial data from a Motorola Oncore GPS receiver and sends a PPS Control (@@Gc) reply with an out-of-range mode byte. Only deployments built and configured with the Motorola Oncore refclock driver and attached to an Oncore-family receiver are exposed, making this a stratum-1 time-server scenario rather than a default configuration. Exploitation requires control of the receiver’s serial path (AV:P), though no authentication is needed once that access is achieved (PR:N); no public exploit code or confirmed active exploitation was identified in the available data.
Heap-based memory corruption in NTPsec ntpd before 1.2.6 affects deployments that explicitly enable the non-default JJY refclock driver in Telephone JJY mode (refclock type 40). An unauthenticated attacker with physical/local control of the Telephone JJY time source can send more than six time replies to the driver, causing heap corruption, an ntpd crash, and high integrity/availability impact; the CVSS score is 6.4 but real-world priority is low because stock configurations do not enable this region-specific driver. No public exploit code was identified at time of analysis.
Buffer overflow in NTPsec's Zyfer refclock driver crashes the ntpd daemon on affected systems running versions prior to 1.2.5. A local, low-privileged attacker with high attack complexity can trigger the CWE-120 classic buffer overflow, resulting in a denial-of-service impact limited to availability - no confidentiality or integrity exposure exists. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ntpkeygen can generate keys that ntpd fails to parse. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required.
An issue was discovered in NTPsec before 1.1.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in NTPsec before 1.1.3. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in NTPsec before 1.1.3. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in NTPsec before 1.1.3. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.