CVEvulnerability

CVE-2018-7185

7.5 HIGH Published 2018-03-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-03-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P

Description

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.

Affected configurations

• ntp ntp (>= 4.2.6 < 4.2.8) • ntp ntp 4.2.8 • synology router manager (>= 1.1 < 1.1.6-6931-3) • synology skynas (< 6.1.5-15254) • synology virtual diskstation manager (< 6.1.6-15266) • synology diskstation manager (>= 5.2 < 6.1.6-15266) • synology vs960hd firmware (< 2.2.3-1505) • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 17.10 • canonical ubuntu linux 18.04 • netapp hci • netapp solidfire • hpe hpux-ntp (< c.4.2.8.4.0) • oracle fujitsu m10-1 firmware (< xcp2361) • oracle fujitsu m10-4 firmware (< xcp2361) • oracle fujitsu m10-4s firmware (< xcp2361) • oracle fujitsu m12-1 firmware (< xcp2361) • oracle fujitsu m12-2 firmware (< xcp2361) • oracle fujitsu m12-2s firmware (< xcp2361) • oracle fujitsu m10-1 firmware (< xcp3070) • oracle fujitsu m10-4 firmware (< xcp3070) • oracle fujitsu m10-4s firmware (< xcp3070) • oracle fujitsu m12-1 firmware (< xcp3070) • oracle fujitsu m12-2 firmware (< xcp3070) • oracle fujitsu m12-2s firmware (< xcp3070)

References