Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade ntp | May 11, 2018 | Mar 8, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 8, 2018 |
| Debian | — | Upgrade ntp | Jul 30, 2024 | Mar 8, 2018 |
| Freebsd | — | Upgrade FreeBSDUpgrade ntpUpgrade ntp-devel | May 6, 2018 | Feb 28, 2018 |
| Gentoo Linux | — | Upgrade net-misc/ntp. | May 29, 2018 | Mar 8, 2018 |
| Hpux | — | Update NTP to the latest version | Dec 9, 2019 | Mar 8, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ntpUpgrade ntpdate | Nov 3, 2020 | Mar 8, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ntpdateUpgrade sntpUpgrade ntp | Nov 19, 2019 | Mar 8, 2018 |
| Ibm Aix | — | Apply the fix or workaround for ntp_advisory10 | Aug 16, 2018 | Mar 8, 2018 |
| Ntp | — | Upgrade to the latest version of NTP | Feb 23, 2023 | Mar 8, 2018 |
| Oracle Solaris | — | Upgrade service/network/ntp to version 4.2.8.11-0.175.3.31.0.4.0 on Solaris 11.3 | Apr 18, 2018 | Mar 8, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 8, 2018 |
| Suse | — | Upgrade ntpUpgrade ntp-doc | Mar 28, 2018 | Mar 8, 2018 |
| Ubuntu | — | Upgrade ntp | Jul 13, 2018 | Mar 8, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub