The vulnerability of the ctl_getitem method in the ntpd daemon, which is part of the NTP time synchronization protocol, arises from reading data within acceptable buffer limits. This allows a malicious actor to cause a service failure.

🗓️ 22 Jan 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

The ctl_getitem flaw in ntpd allows reading beyond buffers, causing service failures via mode six.

Reporter	Title	Published	Views	Family All 89
IBM Security Bulletins	Security Bulletin: Vulnerabilities in ntp affect IBM Integrated Management Module II (IMM2) for System x, Flex and BladeCenter Systems	7 Dec 202322:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in NTP	7 Dec 202322:31	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in NTP, OpenSSL and Intel CPU's affect IBM Netezza Firmware Diagnostics.	18 Oct 201903:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in NTP affect QLogic 8Gb Intelligent Pass-thru Module and SAN Switch Module for IBM BladeCenter and IBM Flex System FC3171 8Gb SAN Switch & SAN Pass-thru	7 Dec 202322:31	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in NTP affect AIX	14 Aug 201821:30	–	ibm
0day.today	ntpd 4.2.8p10 - Out-of-Bounds Read Exploit	14 Nov 201800:00	–	zdt
FreeBSD	ntp -- multiple vulnerabilities	27 Feb 201800:00	–	freebsd
Tenable Nessus	Amazon Linux 2 : ntp (ALAS-2018-1009)	11 May 201800:00	–	nessus
Tenable Nessus	Amazon Linux AMI : ntp (ALAS-2018-1009)	11 May 201800:00	–	nessus
Tenable Nessus	FreeBSD : ntp -- multiple vulnerabilities (af485ef4-1c58-11e8-8477-d05099c0ae8c)	28 Feb 201800:00	–	nessus

Vulners

Node

network_time ntpRange4.2.8p6–4.2.8p11

OR

canonical ubuntuMatch17.10

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html
support	www.support.ntp.org/bin/view/Main/NtpBug3412
securityfocus	www.securityfocus.com/archive/1/541824/100/0/threaded
securityfocus	www.securityfocus.com/bid/103191
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-7182
security	www.security.freebsd.org/advisories/FreeBSD-SA-18:02.ntp.asc
security	www.security.gentoo.org/glsa/201805-12
security	www.security.netapp.com/advisory/ntap-20180626-0001/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2018-7182
usn	www.usn.ubuntu.com/3707-1/

21 Nov 2023 00:00Current

7High risk

Vulners AI Score7

CVSS 25

CVSS 35.3

EPSS0.11077

ntp protocol ctl getitem flaw buffer overflow mode six payloads ntpd daemon