Junglewise Threat Intelligence

CVE-2016-2519: NTP ntpd denial of service in ctl_getitem

CVE-2016-2519 · Severity: medium · CVSS 5.9 · Published 2017-01-30

Executive brief

The Network Time Protocol daemon (ntpd) is a service used to synchronize the clocks of computers across a network. A vulnerability in this service allows a remote attacker to crash the daemon by sending a specially crafted, oversized data request. If exploited, this would stop time synchronization on the affected system, potentially causing issues for applications that rely on accurate system time.

Technical details

A denial of service vulnerability exists in the NTP daemon (ntpd) due to improper handling of large data values in the ctl_getitem() function. An attacker with permission to store and retrieve information in ntpd (via ntpq or ntpdc) can store a data value exceeding the internal buffer size. When a subsequent request is made to retrieve this oversized value, ctl_getitem() returns a NULL pointer; because the return value is not properly validated before being passed to an INSIST() assertion check, the daemon aborts. This issue is fixed in NTP versions 4.2.8p7 and 4.3.92.

Affected products

  • NTP Project ntpd before 4.2.8p7, 4.3.x before 4.3.92

Timeline

  • 2016-04-27: patched: FreeBSD released patches for stable branches
  • 2016-04-29: advisory: FreeBSD Security Advisory SA-16:16 published
  • 2017-01-30: disclosed: NVD publication date

References

Related threats