# CVE-2016-2519: NTP ntpd denial of service in ctl_getitem

Source: https://junglewise.ai/threats/cve-2016-2519-ntp-ntpd-denial-of-service-in-ctl-getitem  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-30. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2016-2519 · Severity: medium · CVSS 5.9 · Published 2017-01-30

The Network Time Protocol daemon (ntpd) is a service used to synchronize the clocks of computers across a network. A vulnerability in this service allows a remote attacker to crash the daemon by sending a specially crafted, oversized data request. If exploited, this would stop time synchronization on the affected system, potentially causing issues for applications that rely on accurate system time.

Technologies: [NTP Project Ntpd](https://junglewise.ai/threats/technologies/ntpd). Vendors: [NTP Project](https://junglewise.ai/threats/vendors/ntp-project).

## Quick answers

**Is CVE-2016-2519 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-2519 being exploited in the wild.

**How severe is CVE-2016-2519?** Medium severity, with a CVSS score of 5.9, published 30 January 2017.

**Which products and versions are affected?** NTP Project Ntpd before 4.2.8p7, 4.3.x before 4.3.92.

**Is there a fix for CVE-2016-2519?** A patch was published on 2016-04-27: FreeBSD released patches for stable branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-2519 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2016-2519?** Check whether you run NTP Project Ntpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in the NTP daemon (ntpd) due to improper handling of large data values in the ctl_getitem() function. An attacker with permission to store and retrieve information in ntpd (via ntpq or ntpdc) can store a data value exceeding the internal buffer size. When a subsequent request is made to retrieve this oversized value, ctl_getitem() returns a NULL pointer; because the return value is not properly validated before being passed to an INSIST() assertion check, the daemon aborts. This issue is fixed in NTP versions 4.2.8p7 and 4.3.92.

## Affected products

- NTP Project ntpd before 4.2.8p7, 4.3.x before 4.3.92

## Timeline

- 2016-04-27: patched: FreeBSD released patches for stable branches
- 2016-04-29: advisory: FreeBSD Security Advisory SA-16:16 published
- 2017-01-30: disclosed: NVD publication date

## References

- [http://support.ntp.org/bin/view/Main/NtpBug3008](http://support.ntp.org/bin/view/Main/NtpBug3008)
- [http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html](http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html)
- [http://www.securityfocus.com/bid/88204](http://www.securityfocus.com/bid/88204)
- [http://www.securitytracker.com/id/1035705](http://www.securitytracker.com/id/1035705)
- [https://security.freebsd.org/advisories/FreeBSD-SA-16:16.ntp.asc](https://security.freebsd.org/advisories/FreeBSD-SA-16:16.ntp.asc)
- [https://security.gentoo.org/glsa/201607-15](https://security.gentoo.org/glsa/201607-15)
- [https://security.netapp.com/advisory/ntap-20171004-0002/](https://security.netapp.com/advisory/ntap-20171004-0002/)

## Related threats

- [NTP Project ntpd origin timestamp validation bypass](https://junglewise.ai/threats/cve-2015-8138-ntp-project-ntpd-origin-timestamp-validation-bypass)
- [NTP Project ntpd denial of service via reslist command](https://junglewise.ai/threats/cve-2015-7977-ntp-project-ntpd-denial-of-service-via-reslist-command)
- [NTP Project ntpd denial of service via large UDP packet on Windows](https://junglewise.ai/threats/cve-2016-9312-ntp-project-ntpd-denial-of-service-via-large-udp-packet-on-windows)
- [NTP Project ntpd denial of service in trap service](https://junglewise.ai/threats/cve-2016-9311-ntp-project-ntpd-denial-of-service-in-trap-service)
- [NTP ntpd information disclosure and DDoS vector in mode 6 control functionality](https://junglewise.ai/threats/cve-2016-9310-ntp-ntpd-information-disclosure-and-ddos-vector-in-mode-6-control)