CVE-2018-7170 : ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated us

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.

Published 2018-03-06 20:29:01

Updated 2020-06-18 14:01:28

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2018-7170

NTP » NTP
Versions from including (>=) 4.3.0 and before (<) 4.3.92
cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*
Matching versions
NTP » NTP
Versions from including (>=) 4.2.0 and before (<) 4.2.8
cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8
cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P2-rc1
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P1
cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P2
cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P1-beta1
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P1-beta2
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P1-beta3
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P1-beta4
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P1-beta5
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P1-rc1
cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P1-rc2
cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P2-rc2
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P2-rc3
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P3
cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P3-rc1
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P3-rc2
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P3-rc3
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P4
cpe:2.3:a:ntp:ntp:4.2.8:p4:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P5
cpe:2.3:a:ntp:ntp:4.2.8:p5:*:*:*:*:*:*
Matching versions
NTP » NTP » Version: 4.2.8 Update P6
cpe:2.3:a:ntp:ntp:4.2.8:p6:*:*:*:*:*:*
Matching versions
Netapp » Solidfire » Version: N/A
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
Matching versions
Netapp » HCI » Version: N/A
cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*
Matching versions
Synology » Diskstation Manager
Versions from including (>=) 5.2 and before (<) 6.1.6-15266
cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*
Matching versions
Synology » Router Manager
Versions from including (>=) 1.1 and before (<) 1.1.6-6931-3
cpe:2.3:a:synology:router_manager:*:*:*:*:*:*:*:*
Matching versions
Synology » Skynas
Versions before (<) 6.1.5-15254
cpe:2.3:a:synology:skynas:*:*:*:*:*:*:*:*
Matching versions
Synology » Virtual Diskstation Manager
Versions before (<) 6.1.6-15266
cpe:2.3:a:synology:virtual_diskstation_manager:*:*:*:*:*:*:*:*
Matching versions
Synology » Vs960hd Firmware
Versions before (<) 2.2.3-1505
cpe:2.3:o:synology:vs960hd_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Synology » Vs960hd » Version: N/A
HPE » Hpux-ntp
Versions before (<) c.4.2.8.4.0
cpe:2.3:a:hpe:hpux-ntp:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2018-7170

Top countries where our scanners detected CVE-2018-7170

Top open port discovered on systems with this issue 21

IPs affected by CVE-2018-7170 7,552

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-7170!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2018-7170

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 50 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-7170

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N	6.8	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N	1.6	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

References for CVE-2018-7170

https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc

Third Party Advisory

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=1550214

1550214 – (CVE-2018-7170) CVE-2018-7170 ntp: Ephemeral association time spoofing additional protection
Issue Tracking;Third Party Advisory
https://security.gentoo.org/glsa/201805-12

NTP: Multiple vulnerabilities (GLSA 201805-12) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://www.synology.com/support/security/Synology_SA_18_13

Synology Inc.
Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20180626-0001/

March 2018 Network Time Protocol Daemon (ntpd) Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html

Slackware Security Advisory - ntp Updates ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securityfocus.com/bid/103194

NTP CVE-2018-7170 Incomplete Fix Remote Security Vulnerability
Third Party Advisory;VDB Entry
http://support.ntp.org/bin/view/Main/NtpBug3415

NtpBug3415 < Main < NTP
Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us

HPESBUX03962 rev.1 - HP-UX NTP service, multiple vulnerabilities
Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/archive/1/541824/100/0/threaded

SecurityFocus
Third Party Advisory;VDB Entry

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-7170

Products affected by CVE-2018-7170

Threat overview for CVE-2018-7170

Exploit prediction scoring system (EPSS) score for CVE-2018-7170

CVSS scores for CVE-2018-7170

References for CVE-2018-7170