WaratekVRT Sign in

CVE-2018-7183 ntp

Affected softwarentp
Severity9.8 Critical CVSS 3.0 2 scores
WeaknessOut-of-bounds write (CWE-787)
Published8 Mar 2018
Updated17 Jun 2026

Description

Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 8 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 10% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.8 CRITICAL v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2021 ↗ CPU 2021-Q3 Oracle Systems / XCP Firmware (NTP) (Prior to XCP2400, prior to XCP3100)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Systems XCP Firmware (NTP) Prior to XCP2400, prior to XCP3100

Products and versions

4 products, 14 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 12.04 · 14.04 · 16.04 · 17.10 · 18.04
nvd freebsd freebsd generic 10.3 · 10.4 · 11.1
nvd netapp element software generic any version
nvd ntp ntp generic 4.2.8:p6 · 4.2.8:p7 · 4.2.8:p8 · 4.2.8:p9 · 4.2.8:p10

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** NTP, XCP FIRMWARE (NTP), NO AUTH REMOTE EXPLOIT **Products:** M10-4, M10-4S, ORACLE SYSTEMS, M12-1, M12-2, M12-2S SERVERS, FUJITSU M10-1

References

URLTags
http://support.ntp.org/bin/view/Main/NtpBug3414 Vendor Advisory
http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S Vendor Advisory
http://www.securityfocus.com/bid/103351 Third Party Advisory, VDB Entry
https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc Third Party Advisory
https://security.gentoo.org/glsa/201805-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20180626-0001/ Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
https://usn.ubuntu.com/3707-1/ Third Party Advisory
https://usn.ubuntu.com/3707-2/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html

Timeline
Published2018-03-08By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.