Finding and exploiting ntpd vulnerabilities
Summary: Project Zero guest researcher Stephen Röttger found CVE-2014-9295, a global buffer overflow in ntpd's control packet handling that he exploited on OS X Mavericks, triggered by an attacker on the local network sending an IPv6 packet with a spoofed ::1 source. Reaching the overflow required bypassing IP restrictions via spoofing and brute-forcing a randomly generated 31-bit control key, whose seed could be recovered offline from the random values returned in time synchronization responses.
What you should know: Default installations of ntpd on Ubuntu, Debian and OS X restrict control queries to 127.0.0.1 and ::1, yet a spoofed IPv6 source on the same local network defeats that restriction, and the fallback random key is only 31 bits. Until patched, the researcher's guidance is to add nomodify or noquery to every restrict line, including localhost.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2014-9295
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026