CVE-2019-6443

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack...

9.1 CriticalPublic exploitFix available

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: High

Exploit likelihood

66.9%Up 62.4 points since Apr 14, 2021

What each source reports

NVD Score used 9.1

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.

Record: CVE-2019-6443
CVSS 3.0: 9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:P/I:N/A:P
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.

Record: CVE-2019-6443
Updated: 2026-11-02

EUVDEUVD-2019-16004 No score

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.

Record: EUVD-2019-16004
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v24q-v22h-25r2 9.1

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack...

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.

Record: GHSA-v24q-v22h-25r2
CVSS 3.0: 9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVALPINE-CVE-2019-6443 9.1

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.

Record: ALPINE-CVE-2019-6443
CVSS 3.0: 9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-03

OSV 9.1

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.

Record: CVE-2019-6443
CVSS 3.0: 9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVDEBIAN-CVE-2019-6443 9.1

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.

Record: DEBIAN-CVE-2019-6443
CVSS 3.0: 9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-6443 9.1

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.

Record: UBUNTU-CVE-2019-6443
CVSS 3.0: 9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2019:0082-1 No score

Security update for ntpsec

This update for ntpsec to version 1.1.3 fixes the following issues:

Security issues fixed:

CVE-2019-6442: Fixed a out of bounds write via a malformed config request (boo#1122132)
CVE-2019-6443: Fixed a stack-based buffer over-read in the ctl_getitem function (boo#1122144)
CVE-2019-6444: Fixed a stack-based buffer over-read in the process_control function (boo#1122134)
CVE-2019-6445: Fixed a NULL pointer dereference in the ctl_getitem function (boo#1122131)

Record: openSUSE-SU-2019:0082-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11103-1 No score

libntpc1-1.2.1-1.2 on GA media

These are all security issues fixed in the libntpc1-1.2.1-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11103-1
Updated: 2026-11-02

Affected products

ntpsec

Affected packages

Affected packages
Package	Affected	Fixed
`ntpsec` Alpine:v3.10	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.11	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.12	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.13	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.14	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.15	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.16	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.17	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.18	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.19	before 1.1.3-r0	1.1.3-r0

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`ntpsec` Alpine:v3.20	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.21	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.22	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.23	before 1.1.3-r0	1.1.3-r0
`ntpsec` Alpine:v3.24	before 1.1.3-r0	1.1.3-r0
`ntpsec` Debian:12	before 1.1.3+dfsg1-1	1.1.3+dfsg1-1
`ntpsec` Debian:13	before 1.1.3+dfsg1-1	1.1.3+dfsg1-1
`ntpsec` Debian:14	before 1.1.3+dfsg1-1	1.1.3+dfsg1-1
`ntpsec` Ubuntu:18.04:LTS	before 1.1.0+dfsg1-1ubuntu0.2, plus listed versions 1.0.0+dfsg1-11.0.0+dfsg1-31.1.0+dfsg1-11.1.0+dfsg1-1ubuntu0.1	1.1.0+dfsg1-1ubuntu0.2
`ntpsec` openSUSE:Tumbleweed	before 1.2.1-1.2	1.2.1-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	NTPsec 1.1.2 - 'ctl_getitem' Out-of-Bounds Read (PoC)	2019-01-16
Nuclei	NTPsec > 1.1.3 - 'ctl_getitem' Out-of-Bounds Read

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-6443 is a critical vulnerability (CVSS 9.1) in Ntpsec, published January 16, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 66.9%, the 99th percentile. Fixed in ntpsec 1.1.3-r0.

References

Show 15 moreShow less