Heap Buffer Overflow in NTPsec NTS Client

Executive Summary

This vulnerability involves an out-of-bounds read and write in the NTS client extension field parsing function (extens_client_recv) in NTPsec versions before 1.2.5. A remote attacker who can send server-mode replies to an NTS client can exploit this to corrupt heap memory and crash ntpd. Additionally, combined with a previously fixed out-of-bounds read in NTS-KE client, it allows bypassing NTS authentication and manipulating the client's time by sending an NTS Authenticator with an Encrypted Extension Fields field containing a nonce length exceeding the field.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves NTS client extension field parsing in NTPsec. Detection requires monitoring for malformed NTS Authenticator and Encrypted Extension Fields with excessive nonce lengths. Check NTPsec logs for crashes or heap corruption errors during NTS client operation.

Useful 0 Not Useful 0

Impact Analysis

If you use NTPsec as a client with NTS enabled, an attacker could crash your ntpd service, disrupting time synchronization. In severe cases, they could manipulate your system time by bypassing authentication, potentially causing issues with time-sensitive applications or security mechanisms that rely on accurate time.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NTPsec to version 1.2.5 or later to address the out-of-bounds read/write issues. Disable NTS client functionality if not required. Monitor network traffic for malformed NTS responses and block suspicious sources.

Useful 0 Not Useful 0