CVE-2018-8956: ntp Improper Input Validation
Vulnerability summary
CVE-2018-8956 is a medium (CVSS 5.3) Improper Input Validation vulnerability in ntp. EPSS estimates a 3.14% chance of exploitation in the next 30 days, higher than 87.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 6Timeline
- 06-05-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker's behalf and send them to the attacker.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
3.14%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
+0.08 pp
From 3.07% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- ntp< 1:4.2.8p14+dfsg-1
Ntp1 product
- ntp4.2.8:p10 | 4.2.8:p11 | 4.2.8:p12 | 4.2.8:p13
Ubuntu1 product
- ntpAll versions (No fix recorded)
3 vendors · 3 products
References
10 links- security.netapp.com/advisory/ntap-20200518-0006/X Refsource CONFIRM
