CVE-2018-7183: Buffer Overflow
Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ntpto a version that resolves this vulnerability.Fixed in 1:4.2.8p15+dfsg-1 - Upgrade
Upgrade
debian/ntpsecto a version that resolves this vulnerability.Fixed in 1.2.0+dfsg1-4Fixed in 1.2.2+dfsg1-1+deb12u1Fixed in 1.2.3+dfsg1-8Fixed in 1.2.4+dfsg-1 - Upgrade
Upgrade
ntpq (NTP)to a version that resolves this vulnerability.Fixed in 4.2.8p6 through 4.2.8p10
Event History
Frequently Asked Questions
What is CVE-2018-7183?
CVE-2018-7183 is a buffer overflow vulnerability in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10.
How does CVE-2018-7183 impact my system?
CVE-2018-7183 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.
What is the severity of CVE-2018-7183?
CVE-2018-7183 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2018-7183?
Ntp 4.2.8p6 through 4.2.8p10, Freebsd 10.3 through 10.4, Freebsd 11.1, and various versions of Ubuntu Linux and Netapp Element Software are affected by CVE-2018-7183.
How can I fix CVE-2018-7183?
To fix CVE-2018-7183, update to at least ntp 4.2.8p12+dfsg-4, ntpsec 1.2.2+dfsg1-2, or the appropriate patched version based on your software distribution.