CVE-2018-12327: ntp Out-of-bounds Write
Vulnerability summary
CVE-2018-12327 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in ntp. EPSS estimates a 28.02% chance of exploitation in the next 30 days, higher than 98% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 20-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated7.0HighCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
28.02%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
-0.69 pp
From 28.71% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 found9B58Ed8E0354E8Deee50B0Eebd1C011F
Maturity: poc
ntp 4.2.8p11 - Local Buffer Overflow (PoC)
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- ntp< 0:4.2.6p5-5.el6_7.6 | < 0:4.2.6p5-15.el6_10 | < 0:4.2.6p5-29.el7 | < 0:4.2.6p5-28.el7_6.1
- ntp-debuginfo< 0:4.2.6p5-5.el6_7.6 | < 0:4.2.6p5-15.el6_10 | < 0:4.2.6p5-29.el7 | < 0:4.2.6p5-28.el7_6.1
- ntp-doc< 0:4.2.6p5-5.el6_7.6 | < 0:4.2.6p5-15.el6_10 | < 0:4.2.6p5-29.el7 | < 0:4.2.6p5-28.el7_6.1
- ntp-perl< 0:4.2.6p5-5.el6_7.6 | < 0:4.2.6p5-15.el6_10 | < 0:4.2.6p5-29.el7 | < 0:4.2.6p5-28.el7_6.1
- ntpdate< 0:4.2.6p5-5.el6_7.6 | < 0:4.2.6p5-15.el6_10 | < 0:4.2.6p5-29.el7 | < 0:4.2.6p5-28.el7_6.1
Debian1 product
- ntpAll versions (No fix recorded)
Mageia1 product
- ntp< 4.2.8p12-1.mga6
Ntp1 product
- ntp4.2.8:p11
Ubuntu1 product
- ntp< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1 | < 1:4.2.8p4+dfsg-3ubuntu5.10 | < 1:4.2.8p10+dfsg-5ubuntu7.3+esm1
5 vendors · 10 products
References
28 links- gist.github.com/fakhrizulkifli/9b58ed8e0354e8deee50b0eebd1c011fX Refsource MISCExploitThird Party AdvisoryREPORT
