PT-2025-9200 · Ntpd-Rs · Ntpd-Rs

Published 2025-02-28 · Updated 2025-02-28

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ntpd-rs versions prior to 1.5.0

Description Two denial of service issues were found in the handling of NTS cookies in the client functionality. These issues can cause ntpd-rs to crash when an NTS source is configured and the server sends zero-sized cookies or cookies larger than the buffer size. The issues can only be exploited by configured NTS sources. For zero-sized cookies, a division by zero error occurs when calculating the number of new cookies to request. For large cookies, the buffer is too small to handle the cookie, causing an exit when attempting to write to the buffer.

Recommendations For versions prior to 1.5.0, update to the latest version to resolve the issue. If an update is impossible, only add trusted NTS sources to ntpd-rs to minimize the risk of exploitation.

Fix

Divide By Zero

Weakness Enumeration

CWE-369

CWE-703

Related Identifiers

GHSA-V83Q-83HJ-RW38

Affected Products

Ntpd-Rs

References · 5

• https://osv.dev/vulnerability/GHSA-v83q-83hj-rw38 · Vendor Advisory
• https://github.com/pendulum-project/ntpd-rs · Note
• https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-v83q-83hj-rw38 · Note
• https://github.com/pendulum-project/ntpd-rs/commit/37dd8d9a0faa03e7dfe3a4bf64953010f075c3e2 · Note
• https://github.com/pendulum-project/ntpd-rs/commit/10a103b471dae25ac598140df0c195b6531bf716 · Note