CVE-2018-8956: Input Validation
ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker's behalf and send them to the attacker.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-8956?
CVE-2018-8956 is a vulnerability in ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12, and 4.2.8p13 that allows remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server.
What is the severity of CVE-2018-8956?
The severity of CVE-2018-8956 is medium (5.3).
How can an attacker exploit CVE-2018-8956?
An attacker can exploit CVE-2018-8956 by sending spoofed mode 3 and mode 5 packets to the target broadcast client, preventing it from synchronizing its clock with a broadcast NTP server.
Which versions of ntp are affected by CVE-2018-8956?
ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12, and 4.2.8p13 are affected by CVE-2018-8956.
Where can I find more information about CVE-2018-8956?
You can find more information about CVE-2018-8956 at the following references: [1] [2] [3]