An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds
    in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in
    ntp_parser.tab.c, and yyerror in ntp_parser.y. (CVE-2019-6442)

  - An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based
    buffer over-read in read_sysvars in ntp_control.c in ntpd. (CVE-2019-6443)

  - An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based
    buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd. (CVE-2019-6444)

  - An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer
    dereference and ntpd crash in ntp_control.c, related to ctl_getitem. (CVE-2019-6445)

This update for ntpsec to version 1.1.3 fixes the following issues :

Security issues fixed :

  - CVE-2019-6442: Fixed a out of bounds write via a     malformed config request (boo#1122132)

  - CVE-2019-6443: Fixed a stack-based buffer over-read in     the ctl_getitem function (boo#1122144)

  - CVE-2019-6444: Fixed a stack-based buffer over-read in     the process_control function (boo#1122134)

  - CVE-2019-6445: Fixed a NULL pointer dereference in the     ctl_getitem function (boo#1122131)

ID	Name	Product	Family	Severity
405895	Alpine: multiple ntpsec packages: security update to 1.1.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405895	Alpine: multiple ntpsec packages: security update to 1.1.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
121340	openSUSE Security Update : ntpsec (openSUSE-2019-82)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-6444

critical

Tenable Plugins

critical

critical

critical