CVE-2018-12327 in the critical feed json
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher pr…
published 8y ago modified 4mo ago also EUVD-2018-4301
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 27.5%
- EPSS 27.5% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source.
Patch / fix
- ntp Ubuntu 16.04 LTS 1:4.2.8p4+dfsg-3ubuntu5.10
- ntp Ubuntu Pro 14.04 LTS 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1
- ntp Ubuntu Pro 18.04 LTS 1:4.2.8p10+dfsg-5ubuntu7.3+esm1
ubuntu advisories UBUNTU-CVE-2018-12327
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- ntp RHEL 7 4.2.6p5-29.el7
- sntp RHEL 7 4.2.6p5-29.el7
- ntpdate RHEL 7 4.2.6p5-29.el7
- ntp-perl RHEL 7 4.2.6p5-29.el7
- ntp RHEL 6 4.2.6p5-15.el6_10
- ntpdate RHEL 6 4.2.6p5-15.el6_10
- ntp-perl RHEL 6 4.2.6p5-15.el6_10
- ntp RHEL 7.6 EUS 4.2.6p5-28.el7_6.1
red hat advisories RHSA-2020:1470RHSA-2019:2077RHSA-2018:3854RHSA-2018:3853
- ntp SLES 12 SP3, SLES 12 SP2-BCL, SLED 12 SP3 +7 more 4.2.8p12-64.8.2
- ntp SLE Module for Legacy 15 4.2.8p12-4.3.2
- ntp SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3 4.2.8p12-48.21.1
- ntp SLES for SAP 11 SP4, SLES 11 SP4 4.2.8p12-64.7.1
- ntp SLES 12-LTSS 4.2.8p12-46.29.2
suse advisories SUSE-SU-2018:3342-2SUSE-SU-2018:3386-1SUSE-SU-2018:3356-1SUSE-SU-2018:3352-1SUSE-SU-2018:3342-1SUSE-SU-2018:3351-1
- ntp openSUSE Tumbleweed 4.2.8p15-7.2
opensuse advisories openSUSE-SU-2024:11102-1
- ntp Arch Linux 4.2.8.p12-1
arch linux advisories AVG-723
Is CVE-2018-12327 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-12327 updated cvss 7.0
ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution
-
Red Hat Enterprise Linux 5 ntpaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux Client (v. 7) ntp 4.2.6p5-29.el7, ntpdate 4.2.6p5-29.el7 Red Hat Enterprise Linux Client Optional (v. 7) sntp 4.2.6p5-29.el7, ntp-perl 4.2.6p5-29.el7 Red Hat Enterprise Linux ComputeNode (v. 7) ntp 4.2.6p5-29.el7, ntpdate 4.2.6p5-29.el7fixed: vendor fix RHSA-2019:2077
-
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) ntp 4.2.6p5-28.el7_6.1, ntpdate 4.2.6p5-28.el7_6.1fixed: vendor fix RHSA-2020:1470
-
Red Hat Enterprise Linux ComputeNode Optional (v. 7) sntp 4.2.6p5-29.el7, ntp-perl 4.2.6p5-29.el7fixed: vendor fix RHSA-2019:2077
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) sntp 4.2.6p5-28.el7_6.1, ntp-perl 4.2.6p5-28.el7_6.1fixed: vendor fix RHSA-2020:1470
-
Red Hat Enterprise Linux Desktop (v. 6) ntp 4.2.6p5-15.el6_10, ntpdate 4.2.6p5-15.el6_10 Red Hat Enterprise Linux Desktop Optional (v. 6) ntp-perl 4.2.6p5-15.el6_10fixed: vendor fix RHSA-2018:3854
-
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) ntp 4.2.6p5-28.el7_6.1, ntpdate 4.2.6p5-28.el7_6.1 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) sntp 4.2.6p5-28.el7_6.1, ntp-perl 4.2.6p5-28.el7_6.1fixed: vendor fix RHSA-2020:1470
-
Red Hat Enterprise Linux HPC Node (v. 6) ntp 4.2.6p5-15.el6_10, ntpdate 4.2.6p5-15.el6_10fixed: vendor fix RHSA-2018:3854
show 15 moreshow fewer
-
Red Hat Enterprise Linux HPC Node EUS (v. 6.7) ntp 4.2.6p5-5.el6_7.6, ntpdate 4.2.6p5-5.el6_7.6fixed: vendor fix RHSA-2018:3853
-
Red Hat Enterprise Linux HPC Node Optional (v. 6) ntp-perl 4.2.6p5-15.el6_10fixed: vendor fix RHSA-2018:3854
-
Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7) ntp-perl 4.2.6p5-5.el6_7.6fixed: vendor fix RHSA-2018:3853
-
Red Hat Enterprise Linux Server (v. 6) ntp 4.2.6p5-15.el6_10, ntpdate 4.2.6p5-15.el6_10fixed: vendor fix RHSA-2018:3854
-
Red Hat Enterprise Linux Server (v. 7) ntp 4.2.6p5-29.el7, ntpdate 4.2.6p5-29.el7fixed: vendor fix RHSA-2019:2077
-
Red Hat Enterprise Linux Server EUS (v. 6.7) ntp 4.2.6p5-5.el6_7.6, ntpdate 4.2.6p5-5.el6_7.6fixed: vendor fix RHSA-2018:3853
-
Red Hat Enterprise Linux Server EUS (v. 7.6) ntp 4.2.6p5-28.el7_6.1, ntpdate 4.2.6p5-28.el7_6.1fixed: vendor fix RHSA-2020:1470
-
Red Hat Enterprise Linux Server Optional (v. 6) ntp-perl 4.2.6p5-15.el6_10fixed: vendor fix RHSA-2018:3854
-
Red Hat Enterprise Linux Server Optional (v. 7) sntp 4.2.6p5-29.el7, ntp-perl 4.2.6p5-29.el7fixed: vendor fix RHSA-2019:2077
-
Red Hat Enterprise Linux Server Optional EUS (v. 6.7) ntp-perl 4.2.6p5-5.el6_7.6fixed: vendor fix RHSA-2018:3853
-
Red Hat Enterprise Linux Server Optional EUS (v. 7.6) sntp 4.2.6p5-28.el7_6.1, ntp-perl 4.2.6p5-28.el7_6.1fixed: vendor fix RHSA-2020:1470
-
Red Hat Enterprise Linux Workstation (v. 6) ntp 4.2.6p5-15.el6_10, ntpdate 4.2.6p5-15.el6_10fixed: vendor fix RHSA-2018:3854
-
Red Hat Enterprise Linux Workstation (v. 7) ntp 4.2.6p5-29.el7, ntpdate 4.2.6p5-29.el7fixed: vendor fix RHSA-2019:2077
-
Red Hat Enterprise Linux Workstation Optional (v. 6) ntp-perl 4.2.6p5-15.el6_10fixed: vendor fix RHSA-2018:3854
-
Red Hat Enterprise Linux Workstation Optional (v. 7) sntp 4.2.6p5-29.el7, ntp-perl 4.2.6p5-29.el7fixed: vendor fix RHSA-2019:2077
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (EDB-44909)
- Published
Exploit prediction
27.51% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-44909 ntp 4.2.8p11 - Local Buffer Overflow (PoC) dos, 2018-06-20
- gist.github.com https://gist.github.com/fakhrizulkifli/9b58ed8e0354e8deee50b0eebd1c011f referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
exploit-db.com
/exploits/44909/
exploit, third-party-advisory, vdb-entry
-
gist.github.com
/fakhrizulkifli/9b58ed8e0354e8deee50b0eebd1c011f
exploit, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:3854
vendor-advisory
-
access.redhat.com
/errata/RHSA-2018:3853
vendor-advisory
-
security.gentoo.org
/glsa/201903-15
vendor-advisory
-
access.redhat.com
/errata/RHSA-2019:2077
vendor-advisory
-
usn.ubuntu.com
/4229-1/
vendor-advisory
-
securityfocus.com
/bid/104517
vdb-entry, third-party-advisory
- support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
Sources
- CVE List CVE-2018-12327
- NVD CVE-2018-12327
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.