Description
An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ntpsec | 1.1.3+dfsg1-1 | — |
| Debian 13 | ntpsec | 1.1.3+dfsg1-1 | — |
| Debian 12 | ntpsec | 1.1.3+dfsg1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | ntpsec | 1.1.0+dfsg1-1ubuntu0.2 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ntpsec | 1.2.1-1.2 | openSUSE-SU-2024:11103-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.23 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.22 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.21 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.20 | ntpsec | 1.1.3-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.18 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.17 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.16 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.15 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.14 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.13 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.12 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.11 | ntpsec | 1.1.3-r0 | — |
| Alpine v3.10 | ntpsec | 1.1.3-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- NTPsec 1.1.2 - 'ctl_getitem' Out-of-Bounds Read (PoC) EDB-46175 · dos · Jan 16, 2019 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- NTPsec > 1.1.3 - 'ctl_getitem' Out-of-Bounds Read javascript/cves/2019/CVE-2019-6443.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- openSUSE-SU-2024:11103-1 libntpc1-1.2.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026