PT-2018-2208 · Ntp+5 · Ntpd+5

Michael Macnair · Published 2018-03-04 · Updated 2024-06-15 · CVE-2018-7183

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ntpd versions 4.2.8p6 through 4.2.8p10

Description The issue is caused by a buffer overflow in the decodearr function in ntpq, which is part of the NTP protocol implementation. This allows a remote attacker to execute arbitrary code by sending a response with a crafted array to an ntpq query. Additionally, there is a risk of Sybil attacks from authenticated peers, where an attacker could create multiple ephemeral associations to win the clock selection of ntpd and modify a victim's clock.

Recommendations For versions 4.2.8p6 through 4.2.8p10, consider disabling the decodearr function in ntpq as a temporary workaround until a patch is available. Restrict access to ntpd to minimize the risk of exploitation. Avoid using ntpq queries that could be used to send crafted arrays until the issue is resolved.

Fix

RCE

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

ALT-PU-2018-1361

BDU:2019-00216

CVE-2018-7183

MGASA-2018-0195

OPENSUSE-SU-2024:11102-1

SUSE-SU-2018:0808-1

SUSE-SU-2018:0956-1

SUSE-SU-2018:1464-1

SUSE-SU-2018:1765-1

SUSE-SU-2018:1765-2

USN-3707-1

USN-3707-2

Affected Products

Alt Linux

Freebsd

Ibm Aix

Suse

Ubuntu

Ntpd

References · 74

• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7183 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-7183 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00216 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:0956-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1765-2 · Vendor Advisory
• https://usn.ubuntu.com/3707-1 · Vendor Advisory
• http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S · Vendor Advisory
• https://usn.ubuntu.com/3707-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1765-1 · Vendor Advisory
• https://security.freebsd.org/advisories/FreeBSD-SA-18:02.ntp.asc · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-7183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7183 · Security Note
• https://ubuntu.com/security/CVE-2018-7184 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0808-1 · Vendor Advisory