Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2018-7185

Опубликовано: 27 фев. 2018
Источник: redhat
CVSS3: 3.1
EPSS Низкий

Описание

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.

Меры по смягчению последствий

Remove the "xleave" option from the "peer HOST xleave" lines in your ntp.conf if it exists, to entirely disable interleaved mode.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 5ntpNot affected
Red Hat Enterprise Linux 6ntpWill not fix
Red Hat Enterprise Linux 7ntpWill not fix
Red Hat Enterprise Linux 8ntpFix deferred

Показывать по

Дополнительная информация

Статус:

Low
https://bugzilla.redhat.com/show_bug.cgi?id=1550220ntp: Unauthenticated packet can reset authenticated interleaved association

EPSS

Процентиль: 86%
0.0292
Низкий

3.1 Low

CVSS3

Связанные уязвимости

CVSS3: 7.5
ubuntu
почти 8 лет назад

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.

CVSS3: 7.5
nvd
почти 8 лет назад

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.

CVSS3: 7.5
debian
почти 8 лет назад

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attac ...

CVSS3: 7.5
github
больше 3 лет назад

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.

CVSS3: 5.3
fstec
почти 8 лет назад

Уязвимость реализации протокола синхронизации времени NTP, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 86%
0.0292
Низкий

3.1 Low

CVSS3