CVE catalog

CVE-2018-7185

ntpsec: CVE-2018-7185

[CVE catalog]

Severity
Low · CVSS 3.1CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
9.00% · Oct 25, 2026

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianntpsecsid1.2.5+dfsg-1not affected
Debianntpsecforky1.2.5+dfsg-1not affected
Debianntpsectrixie1.2.3+dfsg1-8not affected
Debianntpsecbookworm1.2.2+dfsg1-1+deb12u1not affected
Debianntpsecbookworm-security1.2.2+dfsg1-1+deb12u1not affected
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2vulnerable
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.1vulnerable
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.2vulnerable
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.3vulnerable
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.5vulnerable
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.6vulnerable
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.7vulnerable
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.8vulnerable
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.10vulnerable
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.11vulnerable
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.12vulnerable
Ubuntuntp14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.13fixed
Ubuntuntp16.041:4.2.6.p5+dfsg-3ubuntu8vulnerable
Ubuntuntp16.041:4.2.6.p5+dfsg-3ubuntu8.1vulnerable
Ubuntuntp16.041:4.2.6.p5+dfsg-3ubuntu9vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu1vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu2vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu3vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu4vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu5vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu5.1vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu5.2vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu5.3vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu5.4vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu5.5vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu5.6vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu5.7vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu5.8vulnerable
Ubuntuntp16.041:4.2.8p4+dfsg-3ubuntu5.9fixed
Ubuntuntp18.041:4.2.8p10+dfsg-5ubuntu3vulnerable
Ubuntuntp18.041:4.2.8p10+dfsg-5ubuntu4vulnerable
Ubuntuntp18.041:4.2.8p10+dfsg-5ubuntu5vulnerable
Ubuntuntp18.041:4.2.8p10+dfsg-5ubuntu6vulnerable
Ubuntuntp18.041:4.2.8p10+dfsg-5ubuntu7vulnerable
Ubuntuntp18.041:4.2.8p10+dfsg-5ubuntu7.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianntpsecsourcesidNot affectedunimportantNot reportedNot reported
DebianntpsecsourceforkyNot affectedunimportantNot reportedNot reported
DebianntpsecsourcetrixieNot affectedunimportantNot reportedNot reported
DebianntpsecsourcebookwormNot affectedunimportantNot reportedNot reported
Ubuntuntpdeb14.041:4.2.6.p5+dfsg-3ubuntu2.14.04.13Not reportedUBUNTU-CVE-2018-7185Not reported
Ubuntuntpdeb16.041:4.2.8p4+dfsg-3ubuntu5.9Not reportedUBUNTU-CVE-2018-7185Not reported
Ubuntuntpdeb18.041:4.2.8p10+dfsg-5ubuntu7.1Not reportedUBUNTU-CVE-2018-7185Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ntp]Not affected

    Source package: [ntpsec]

    Details (4)

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

  • [ntpdate]Not affected

    Source package: [ntpsec]

    Details (4)

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

  • [ntp-doc]Not affected

    Source package: [ntpsec]

    Details (4)

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

  • [ntpsec]Not affected
    Details (4)

    • 1.2.2+dfsg1-1+deb12u1 · amd64 · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · arm64 · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · amd64 · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · arm64 · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

  • [ntpsec-doc]Not affected

    Source package: [ntpsec]

    Details (4)

    • 1.2.2+dfsg1-1+deb12u1 · all · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · all · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · all · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · all · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

  • [ntpsec-ntpdate]Not affected

    Source package: [ntpsec]

    Details (4)

    • 1.2.2+dfsg1-1+deb12u1 · amd64 · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · arm64 · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · amd64 · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · arm64 · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

  • [ntpsec-ntpdig]Not affected

    Source package: [ntpsec]

    Details (4)

    • 1.2.2+dfsg1-1+deb12u1 · amd64 · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · arm64 · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · amd64 · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · arm64 · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

  • [ntpsec-ntpviz]Not affected

    Source package: [ntpsec]

    Details (4)

    • 1.2.2+dfsg1-1+deb12u1 · amd64 · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · arm64 · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · amd64 · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · arm64 · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

  • [python3-ntp]Not affected

    Source package: [ntpsec]

    Details (4)

    • 1.2.2+dfsg1-1+deb12u1 · amd64 · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · arm64 · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · amd64 · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1.2.2+dfsg1-1+deb12u1 · arm64 · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

  • [sntp]Not affected

    Source package: [ntpsec]

    Details (4)

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

    • 1:4.2.8p15+dfsg-2~1.2.2+dfsg1-1+deb12u1 · all · bookworm-security

      Not affected

      dsa · ntpsec · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]