CVE-2018-7185: High severity NTP ntp vulnerability
Last updated 25 August 2025
Other sources
The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ntpto a version that resolves this vulnerability.Fixed in 1:4.2.8p15+dfsg-1 - Upgrade
Upgrade
debian/ntpsecto a version that resolves this vulnerability.Fixed in 1.2.0+dfsg1-4Fixed in 1.2.2+dfsg1-1+deb12u1Fixed in 1.2.3+dfsg1-8Fixed in 1.2.4+dfsg-1 - Upgrade
Upgrade
ntpto a version that resolves this vulnerability.Fixed in 4.2.8p11
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7185?
CVE-2018-7185 has been classified as a denial of service vulnerability.
How do I fix CVE-2018-7185?
To mitigate CVE-2018-7185, upgrade to ntp version 4.2.8p11 or later.
What software is affected by CVE-2018-7185?
CVE-2018-7185 affects multiple versions of ntp before 4.2.8p11.
What type of attack does CVE-2018-7185 facilitate?
CVE-2018-7185 allows remote attackers to cause a denial of service by sending specially crafted packets.
Can CVE-2018-7185 impact my network security?
Yes, exploiting CVE-2018-7185 can disrupt NTP services and negatively affect network availability.