NetSight
IP …
medium5.3

CVE-2018-7170

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral as…

Impact

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.

Affected products

VendorProductAffected versions
NtpNtp
from 4.2.0 before 4.2.8
from 4.3.0 before 4.3.92
Version 4.2.8
SynologyRouter Manager
from 1.1 before 1.1.6-6931-3
SynologySkynas
before 6.1.5-15254
SynologyVirtual Diskstation Manager
before 6.1.6-15266
SynologyDiskstation Manager
from 5.2 before 6.1.6-15266
SynologyVs960hd Firmware
before 2.2.3-1505
NetappHci
All versions
NetappSolidfire
All versions
HpeHpux-Ntp
before c.4.2.8.4.0

References