CVE-2018-8956
MEDIUM EPSS 86.0%
Published May 6, 20206y ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Published May 6, 2020 6y ago
Last Modified Jun 17, 2026 2w ago
Description
ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker's behalf and send them to the attacker.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability Low
Threat Intelligence
EPSS Exploit Probability
86.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-20 Improper Input Validation Validation
Affected Products 4
References 7
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html
- ntp.org http://www.ntp.org/
- arxiv.org https://arxiv.org/abs/2005.01783
- nikhiltripathi.in https://nikhiltripathi.in/NTP_attack.pdf
- security.netapp.com https://security.netapp.com/advisory/ntap-20200518-0006/
- tools.ietf.org https://tools.ietf.org/html/rfc5905
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.