Out-of-Bounds Read in NTPsec ntpd NTS Extension

Executive Summary

This vulnerability is an out-of-bounds read issue in the NTS extension field parsing of NTPsec ntpd versions 1.1.4 through 1.2.5. It occurs when a remote attacker sends an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length, causing the daemon to crash.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a remote attacker to crash the NTP daemon, potentially disrupting time synchronization services. If exploited, it could lead to denial-of-service conditions affecting systems relying on accurate timekeeping.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It is a denial-of-service issue in NTPsec's NTS extension handling that could disrupt time synchronization services. Compliance impacts would only occur if the service disruption affected systems subject to these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update NTPsec ntpd to a version that includes the fix for issue #895, specifically commit 7cc07938 or later. This involves modifying the nonce length validation in nts_extens.c to ensure it matches the expected NONCE_LENGTH and verifying CMAC length matches CMAC_LENGTH.

Useful 0 Not Useful 0