Is CVE-2016-2519 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-2519 being exploited in the wild.

How severe is CVE-2016-2519?

Medium severity, with a CVSS score of 5.9, published 30 January 2017.

Which products and versions are affected?

NTP Project Ntpd before 4.2.8p7, 4.3.x before 4.3.92.

Is there a fix for CVE-2016-2519?

A patch was published on 2016-04-27: FreeBSD released patches for stable branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-2519 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2016-2519?

Check whether you run NTP Project Ntpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-2519: NTP ntpd denial of service in ctl_getitem

CVE-2016-2519 · Severity: medium · CVSS 5.9 · Published 2017-01-30

The Network Time Protocol daemon (ntpd) is a service used to synchronize the clocks of computers across a network. A vulnerability in this service allows a remote attacker to crash the daemon by sending a specially crafted, oversized data request. If exploited, this would stop time synchronization on the affected system, potentially causing issues for applications that rely on accurate system time.

Technologies: NTP Project Ntpd. Vendors: NTP Project.

Quick answers

Is CVE-2016-2519 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-2519 being exploited in the wild.
How severe is CVE-2016-2519?: Medium severity, with a CVSS score of 5.9, published 30 January 2017.
Which products and versions are affected?: NTP Project Ntpd before 4.2.8p7, 4.3.x before 4.3.92.
Is there a fix for CVE-2016-2519?: A patch was published on 2016-04-27: FreeBSD released patches for stable branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-2519 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2016-2519?: Check whether you run NTP Project Ntpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial of service vulnerability exists in the NTP daemon (ntpd) due to improper handling of large data values in the ctl_getitem() function. An attacker with permission to store and retrieve information in ntpd (via ntpq or ntpdc) can store a data value exceeding the internal buffer size. When a subsequent request is made to retrieve this oversized value, ctl_getitem() returns a NULL pointer; because the return value is not properly validated before being passed to an INSIST() assertion check, the daemon aborts. This issue is fixed in NTP versions 4.2.8p7 and 4.3.92.

Affected products

NTP Project ntpd before 4.2.8p7, 4.3.x before 4.3.92

Timeline

2016-04-27: patched: FreeBSD released patches for stable branches
2016-04-29: advisory: FreeBSD Security Advisory SA-16:16 published
2017-01-30: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.