Last updated 25 August 2025
Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.
Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
Last updated 24 July 2024
Last updated 24 July 2024
Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.
ntp. Multiple issues were addressed by updating to version 4.2.8p10
ntp. Multiple issues were addressed by updating to version 4.2.8p10
As per upstream NTP security advisory, multiple buffer overflows were reported in ntp daemon, details provided below
Buffer overflow in cryptorecv()
When Autokey Authentication is enabled (i.e. the ntp.conf file contains a 'crypto pw ...' directive) a remote attacker can send a carefully crafted packet that can overflow a stack buffer and potentially allow malicious code to be executed with the privilege level of the ntpd process. This vulnerability was discovered by Stephen Roettger of the Google Security Team.
Mitigation: Disable Autokey Authentication by removing, or commenting out, all configuration directives beginning with the crypto keyword in your ntp.conf file.
Buffer overflow in ctlputdata()
A remote attacker can send a carefully crafted packet that can overflow a stack buffer and potentially allow malicious code to be executed with the privilege level of the ntpd process. This vulnerability was discovered by Stephen Roettger of the Google Security Team.
Buffer overflow in configure()
A remote attacker can send a carefully crafted packet that can overflow a stack buffer and potentially allow malicious code to be executed with the privilege level of the ntpd process. This vulnerability was discovered by Stephen Roettger of the Google Security Team.
Last updated 25 August 2025
It was found that when NTP is configured in broadcast mode, an off-path attacker could broadcast packets with bad authentication (wrong key, mismatched key, incorrect MAC, etc) to all clients. The clients, upon receiving the malformed packets, would break the association with the broadcast server. This could cause the time on affected clients to become out of sync over a longer period of time.
Upstream patch:
https://github.com/ntp-project/ntp/commit/fe46889f7baa75fc8e6c0fcde87706d396ce1461
Last updated 25 August 2025
Last updated 25 August 2025
It was found that ntpd exits with a segmentation fault when a statistics type that was not enabled during compilation (e.g. timingstats) is referenced by the statistics or filegen configuration command, for example:
ntpq -c ':config statistics timingstats' ntpq -c ':config filegen timingstats'
Upstream patch:
http://bk.ntp.org/ntp-dev/?PAGE=patch&REV=4d253ed0A400LyhRQIV0u23NJwuGAA
(in 4.2.6, the code than handles NULL == filegen needs to be adjusted as the outer loop was changed from while to for)
Last updated 25 August 2025
Last updated 25 August 2025
Last updated 24 July 2024
NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.
ntpd in NTP before 4.2.8p9, when running on Windows, allows remote attackers to cause a denial of service via a large UDP packet.
NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPIDLLS environment variable.
The readnetworkpacket function in ntpio.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a packet from the ::1 address.
Apple Security Team reported a stack buffer overflow exists in the ntpq program. When the ntpq program is used to request peer information from a remote time server, a maliciously crafted response may lead to an unexpected application termination or arbitrary code execution.
Problem exists in cookedprint() function in ntpq.c, when server-supplied numeric value is sprintf-ed to the buffer that is not large enough to hold string representation of the maximum possible value.
Last updated 25 August 2025
A vulnerability found in the NTP server allows an authenticated remote attacker to crash the daemon by sending an invalid setting via the :config directive. The unpeer option expects a number or an address as an argument. In case the value is "0", a segmentation fault occurs.
Affects: All versions of ntp, up to but not including ntp-4.2.8p10, and ntp-4.3.0 up to, but not including ntp-4.3.94.
Mitigation:
Properly monitor your ntpd instances, and auto-restart ntpd (without -g) if it stops running.
A vulnerability found in the NTP server makes it possible for an authenticated remote user to crash ntpd via a malformed mode configuration directive.
Mitigation:
Properly monitor your ntpd instances, and auto-restart ntpd (without -g) if it stops running.
NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.
ntprequest.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODEPRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODEPRIVATE error responses between two NTP daemons.
The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service (application crash).
Last updated 25 August 2025
Last updated 24 July 2024