CVE-2018-7184
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp,...
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
- Record
CVE-2018-7184- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
- Record
CVE-2018-7184- Updated
- 2026-11-02
EUVDEUVD-2018-18926 No score
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
- Record
EUVD-2018-18926- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rf4v-73h8-p6f7
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp,...
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
- Record
GHSA-rf4v-73h8-p6f7- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
- Record
CVE-2018-7184- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-7184
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
- Record
DEBIAN-CVE-2018-7184- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVUBUNTU-CVE-2018-7184
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
- Record
UBUNTU-CVE-2018-7184- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0195 No score
Updated ntp packages fix security vulnerabilities
This release addresses five security issues in ntpd for Mageia 6:
LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephemeral association attack While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. Reported by Matt Van Gundy of Cisco.
INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak Reported by Yihan Lian of Qihoo 360.
LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated ephemeral associations. Reported on the questions@ list.
LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode cannot recover from bad state. Reported by Miroslav Lichvar of Red Hat.
LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet can reset authenticated interleaved association. Reported by Miroslav Lichvar of Red Hat.
one security issue in ntpq: MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909: ntpq:decodearr() can write beyond its buffer limit. Reported by Michael Macnair of Thales-esecurity.com.
and provides over 33 bugfixes and 32 other improvements. ENotification of these issues were delivered to our Institutional members on a rolling basis as they were reported and as progress was made.
- Record
MGASA-2018-0195- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11102-1 No score
ntp-4.2.8p15-7.2 on GA media
These are all security issues fixed in the ntp-4.2.8p15-7.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11102-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0808-1 No score
Security update for ntp
This update for ntp fixes the following issues:
Security issues fixed:
- CVE-2016-1549: Significant additional protections against CVE-2016-1549 that was fixed in ntp-4.2.8p7 (bsc#1082210).
- CVE-2018-7170: Ephemeral association time spoofing additional protection (bsc#1083424).
- CVE-2018-7182: Buffer read overrun leads information leak in ctl_getitem() (bsc#1083426).
- CVE-2018-7183: decodearr() can write beyond its buffer limit (bsc#1083417).
- CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state (bsc#1083422).
- CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association (bsc#1083420).
Bug fixes:
- bsc#1077445: Don't use libevent's cached time stamps in sntp.
- Disable CMAC in ntp when building against a version of OpenSSL that doesn't support it.
- Record
SUSE-SU-2018:0808-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0956-1 No score
Security update for ntp
This update for ntp fixes the following issues:
- Update to 4.2.8p11 (bsc#1082210):
- CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
- CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
- CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
- CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
- CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
- CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
- Don't use libevent's cached time stamps in sntp. (bsc#1077445)
- Record
SUSE-SU-2018:0956-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:1464-1 No score
Security update for ntp
This update for ntp fixes the following issues:
- Update to 4.2.8p11 (bsc#1082210):
- CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
- CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
- CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
- CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
- CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
- CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
- Don't use libevent's cached time stamps in sntp. (bsc#1077445)
- Fix systemd migration in %pre (bsc#1034892).
- Record
SUSE-SU-2018:1464-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:1765-1 No score
Security update for ntp
This update for ntp fixes the following issues:
- Update to 4.2.8p11 (bsc#1082210):
- CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
- CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
- CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
- CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
- CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
- CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
- Don't use libevent's cached time stamps in sntp. (bsc#1077445)
This update is a reissue of the previous update with LTSS channels included.
- Record
SUSE-SU-2018:1765-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:1765-2 No score
Security update for ntp
This update for ntp fixes the following issues:
- Update to 4.2.8p11 (bsc#1082210):
- CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
- CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
- CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
- CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
- CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
- CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
- Don't use libevent's cached time stamps in sntp. (bsc#1077445)
This update is a reissue of the previous update with LTSS channels included.
- Record
SUSE-SU-2018:1765-2- Updated
- 2026-11-02
OSVUSN-3707-1 No score
ntp vulnerabilities
Yihan Lian discovered that NTP incorrectly handled certain malformed mode 6 packets. A remote attacker could possibly use this issue to cause ntpd to crash, resulting in a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7182)
Michael Macnair discovered that NTP incorrectly handled certain responses. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2018-7183)
Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7184)
Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2018-7185)
- Record
USN-3707-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ntpDebian:11 |
before 1:4.2.8p11+dfsg-1 | 1:4.2.8p11+dfsg-1 |
ntpMageia:6 From an advisory covering 6 CVEs |
before 4.2.8p11-1.mga6 | 4.2.8p11-1.mga6 |
ntpSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 6 CVEs |
before 4.2.8p11-64.4.1 | 4.2.8p11-64.4.1 |
ntpSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 6 CVEs |
before 4.2.8p11-64.4.1 | 4.2.8p11-64.4.1 |
ntpSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 6 CVEs |
before 4.2.8p11-64.3.2 | 4.2.8p11-64.3.2 |
ntpSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 6 CVEs |
before 4.2.8p11-64.3.2 | 4.2.8p11-64.3.2 |
ntpSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 6 CVEs |
before 4.2.8p11-64.3.2 | 4.2.8p11-64.3.2 |
ntpSUSE:Linux Enterprise Server 12-LTSS From an advisory covering 6 CVEs |
before 4.2.8p11-46.26.2 | 4.2.8p11-46.26.2 |
ntpSUSE:OpenStack Cloud 7 From an advisory covering 6 CVEs |
before 4.2.8p11-64.5.1 | 4.2.8p11-64.5.1 |
ntpSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 6 CVEs |
before 4.2.8p11-64.5.1 | 4.2.8p11-64.5.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ntpSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 6 CVEs |
before 4.2.8p11-64.5.1 | 4.2.8p11-64.5.1 |
ntpSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 6 CVEs |
before 4.2.8p11-64.5.1 | 4.2.8p11-64.5.1 |
ntpSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 6 CVEs |
before 4.2.8p11-64.5.1 | 4.2.8p11-64.5.1 |
ntpSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 6 CVEs |
before 4.2.8p11-64.5.1 | 4.2.8p11-64.5.1 |
ntpSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 6 CVEs |
before 4.2.8p11-64.5.1 | 4.2.8p11-64.5.1 |
ntpSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 6 CVEs |
before 4.2.8p11-64.5.1 | 4.2.8p11-64.5.1 |
ntpSUSE:Enterprise Storage 4 From an advisory covering 6 CVEs |
before 4.2.8p11-64.5.1 | 4.2.8p11-64.5.1 |
ntpSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 6 CVEs |
before 4.2.8p11-64.5.1 | 4.2.8p11-64.5.1 |
ntpUbuntu:18.04:LTS |
before 1:4.2.8p10+dfsg-5ubuntu7.1, plus listed versions 1:4.2.8p10+dfsg-5ubuntu31:4.2.8p10+dfsg-5ubuntu41:4.2.8p10+dfsg-5ubuntu51:4.2.8p10+dfsg-5ubuntu61:4.2.8p10+dfsg-5ubuntu7 |
1:4.2.8p10+dfsg-5ubuntu7.1 |
ntpUbuntu:14.04:LTS From an advisory covering 4 CVEs |
before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13, plus listed versions 1:4.2.6.p5+dfsg-3ubuntu21:4.2.6.p5+dfsg-3ubuntu2.14.04.11:4.2.6.p5+dfsg-3ubuntu2.14.04.21:4.2.6.p5+dfsg-3ubuntu2.14.04.31:4.2.6.p5+dfsg-3ubuntu2.14.04.5 Show 6 moreShow less1:4.2.6.p5+dfsg-3ubuntu2.14.04.61:4.2.6.p5+dfsg-3ubuntu2.14.04.71:4.2.6.p5+dfsg-3ubuntu2.14.04.81:4.2.6.p5+dfsg-3ubuntu2.14.04.101:4.2.6.p5+dfsg-3ubuntu2.14.04.111:4.2.6.p5+dfsg-3ubuntu2.14.04.12 |
1:4.2.6.p5+dfsg-3ubuntu2.14.04.13 |
ntpUbuntu:16.04:LTS From an advisory covering 4 CVEs |
before 1:4.2.8p4+dfsg-3ubuntu5.9, plus listed versions 1:4.2.6.p5+dfsg-3ubuntu81:4.2.6.p5+dfsg-3ubuntu8.11:4.2.6.p5+dfsg-3ubuntu91:4.2.8p4+dfsg-3ubuntu11:4.2.8p4+dfsg-3ubuntu2 Show 11 moreShow less1:4.2.8p4+dfsg-3ubuntu31:4.2.8p4+dfsg-3ubuntu41:4.2.8p4+dfsg-3ubuntu51:4.2.8p4+dfsg-3ubuntu5.11:4.2.8p4+dfsg-3ubuntu5.21:4.2.8p4+dfsg-3ubuntu5.31:4.2.8p4+dfsg-3ubuntu5.41:4.2.8p4+dfsg-3ubuntu5.51:4.2.8p4+dfsg-3ubuntu5.61:4.2.8p4+dfsg-3ubuntu5.71:4.2.8p4+dfsg-3ubuntu5.8 |
1:4.2.8p4+dfsg-3ubuntu5.9 |
ntpUbuntu:18.04:LTS From an advisory covering 4 CVEs |
before 1:4.2.8p10+dfsg-5ubuntu7.1, plus listed versions 1:4.2.8p10+dfsg-5ubuntu31:4.2.8p10+dfsg-5ubuntu41:4.2.8p10+dfsg-5ubuntu51:4.2.8p10+dfsg-5ubuntu61:4.2.8p10+dfsg-5ubuntu7 |
1:4.2.8p10+dfsg-5ubuntu7.1 |
ntpopenSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 4.2.8p15-7.2 | 4.2.8p15-7.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7184 is a high vulnerability (CVSS 7.5) in Ntp, published March 6, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.63%, the 95th percentile. Fixed in ntp 1:4.2.8p11+dfsg-1.
References
packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html
securityfocus.com/bid/103192
security.gentoo.org/glsa/201805-12
security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc
security.netapp.com/advisory/ntap-20180626-0001
Show 50 moreShow less
support.ntp.org/bin/view/Main/NtpBug3453
usn.ubuntu.com/3707-1
synology.com/support/security/Synology_SA_18_13
support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
nvd.nist.gov/vuln/detail/CVE-2018-7184
github.com/advisories/GHSA-rf4v-73h8-p6f7
security-tracker.debian.org/tracker/CVE-2018-7184
advisories.mageia.org/MGASA-2018-0195.html
bugs.mageia.org/show_bug.cgi?id=22850
suse.com/support/update/announcement/2018/suse-su-20180808-1
bugzilla.suse.com/1077445
ubuntu.com/security/CVE-2018-7184
kb.cert.org/vuls/id/961909
cve.org/CVERecord?id=CVE-2018-7184