Published: 06/03/2018 Updated: 31/10/2019

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The ctl_getitem method in ntpd in ntp-4.2.8p6 prior to 4.2.8p11 allows remote malicious users to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 up to and including 4.2.8p10.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ntp ntp 4.2.8
canonical ubuntu linux 17.10
canonical ubuntu linux 18.04
netapp element software -

Several security issues were fixed in NTP ...

Ephemeral association time spoofing additional protectionntpd in ntp 42x before 428p7 and 43x before 4392 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack This issue exists because of an ...

The ctl_getitem method in ntpd in ntp-428p6 before 428p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 428p6 through 428p10 ...

ctl_getitem() is used by ntpd to process incoming mode 6 packets A malicious mode 6 packet can be sent to an ntpd instance, and if the ntpd instance is from 428p6 thru 428p10, that will cause ctl_getitem() to read past the end of its buffer ...

# Exploit Title: ntpd 428p10 - Out-of-Bounds Read (PoC) # Bug Discovery: Yihan Lian, a security researcher of Qihoo 360 GearTeam # Exploit Author: Magnus Klaaborg Stubman (@magnusstubman) # Website: dumpcore/blog/cve-2018-7182 # Vendor Homepage: wwwntporg/ # Software Link: wwweecisudeledu/~ntp/ntp_spool/ntp4/ntp-42/n ...

ntpd version 428p10 out-of-bounds read proof of concept exploit ...

CWE-125 http://www.securityfocus.com/bid/103191 http://support.ntp.org/bin/view/Main/NtpBug3412 http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc https://www.synology.com/support/security/Synology_SA_18_13 https://security.netapp.com/advisory/ntap-20180626-0001/https://usn.ubuntu.com/3707-1/http://www.securityfocus.com/archive/1/541824/100/0/threaded https://security.gentoo.org/glsa/201805-12 https://www.exploit-db.com/exploits/45846/https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us https://usn.ubuntu.com/3707-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/45846/

CVE-2018-7182

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect