CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 2CVE-2018-12327 – ntp 4.2.8p11 - Local Buffer Overflow (PoC)
https://notcve.org/view.php?id=CVE-2018-12327
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source. Desbordamiento de búfer basado en pila en ntpq y ntpdc en NTP 4.2.8p11 permite que un atacante logre la ejecución de código o escale a mayores privilegios mediante una cadena larga en el argumento para un parámetro command-line IPv4 o IPv6. NOTA: no se sabe a ciencia cierta si hay situaciones comunes en las que se emplea ntpq o ntpdc con una línea de comando de un origen no fiable. The ntpq and ntpdc command-line utilities that are part of ntp package are vulnerable to stack-based buffer overflow via crafted hostname. • https://www.exploit-db.com/exploits/44909 http://www.securityfocus.com/bid/104517 https://access.redhat.com/errata/RHSA-2018:3853 https://access.redhat.com/errata/RHSA-2018:3854 https://access.redhat.com/errata/RHSA-2019:2077 https://gist.github.com/fakhrizulkifli/9b58ed8e0354e8deee50b0eebd1c011f https://security.gentoo.org/glsa/201903-15 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us https://usn.ubuntu.com/4229-1 https://access.redh • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 71%CPEs: 14EXPL: 0CVE-2018-7183
https://notcve.org/view.php?id=CVE-2018-7183
Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array. Desbordamiento de búfer en la función decodearr en ntpq en ntp, desde la versión 4.2.8p6 hasta la 4.2.8p10, permite que atacantes remotos ejecuten código arbitrario aprovechando una consulta ntpq y enviando una respuesta con un array manipulado. • http://support.ntp.org/bin/view/Main/NtpBug3414 http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S http://www.securityfocus.com/bid/103351 https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc https://security.gentoo.org/glsa/201805-12 https://security.netapp.com/advisory/ntap-20180626-0001 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us https://usn.ubuntu.com/3707-1 https://usn • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 11%CPEs: 8EXPL: 1CVE-2018-7182 – ntpd 4.2.8p10 - Out-of-Bounds Read (PoC)
https://notcve.org/view.php?id=CVE-2018-7182
The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10. el método ctl_getitem en ntpd en ntp, en versiones 4.2.8p6 anteriores a la 4.2.8p11 permite que atacantes remotos provoquen una denegación de servicio (lectura fuera de límites) mediante un paquete mode 6 manipulado con una instancia ntpd desde la versión 4.2.8p6 hasta la 4.2.8p10. • https://www.exploit-db.com/exploits/45846 http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html http://support.ntp.org/bin/view/Main/NtpBug3412 http://www.securityfocus.com/archive/1/541824/100/0/threaded http://www.securityfocus.com/bid/103191 https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc https://security.gentoo.org/glsa/201805-12 https://security.netapp.com/advisory/ntap-20180626-0001 https://support.hpe.com/hpsc/doc/public/ • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 3%CPEs: 63EXPL: 0CVE-2018-7185
https://notcve.org/view.php?id=CVE-2018-7185
The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association. El motor de protocolo en ntp, en versiones 4.2.6 anteriores a la 4.2.8p11, permite que atacantes remotos provoquen una denegación de servicio (interrupción) mediante el envío continuado de un paquete con una marca de tiempo zero-origin y la dirección IP de origen "del otro lado" de una asociación intercalada que provoca que el ntpd de la víctima restablezca su asociación. • http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html http://support.ntp.org/bin/view/Main/NtpBug3454 http://www.securityfocus.com/archive/1/541824/100/0/threaded http://www.securityfocus.com/bid/103339 https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc https://security.gentoo.org/glsa/201805-12 https://security.netapp.com/advisory/ntap-20180626-0001 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en&# •
CVSS: 7.5EPSS: 2%CPEs: 23EXPL: 0CVE-2018-7184
https://notcve.org/view.php?id=CVE-2018-7184
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704. ntpd en ntp, en versiones 4.2.8p4 anteriores a la 4.2.8p11, envía paquetes malos antes de actualizar la marca de tiempo "received". Esto permite que atacantes remotos provoquen una denegación de servicio (interrupción) mediante el envío de un paquete con una marca de tiempo zero-origin que provoca que la asociación se restablezca y establezca el contenido del paquete como la marca de tiempo más reciente. Este problema es el resultado de una solución incompleta para CVE-2015-7704. • http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html http://support.ntp.org/bin/view/Main/NtpBug3453 http://www.securityfocus.com/archive/1/541824/100/0/threaded http://www.securityfocus.com/bid/103192 https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc https://security.gentoo.org/glsa/201805-12 https://security.netapp.com/advisory/ntap-20180626-0001 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en&# •