CVE-2018-7170
Medium
Description
ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.
SeverityMedium
CVSS5.3
Exploit probability—
ProductNtp
PublishedMar 6, 2018
First seenMar 6, 2018
How to fix
Update
- ntp ntp4.2.8, 4.3.92 or later
- synology router_manager1.1.6-6931-3 or later
- synology skynas6.1.5-15254 or later
- synology virtual_diskstation_manager6.1.6-15266 or later
- synology diskstation_manager6.1.6-15266 or later
- synology vs960hd_firmware2.2.3-1505 or later
- hpe hpux-ntpc.4.2.8.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ntp ntp | 4.2.0 ≤ v < 4.2.8, 4.3.0 ≤ v < 4.3.92, 4.2.8 | 4.2.8, 4.3.92 |
| synology router_manager | 1.1 ≤ v < 1.1.6-6931-3 | 1.1.6-6931-3 |
| synology skynas | v < 6.1.5-15254 | 6.1.5-15254 |
| synology virtual_diskstation_manager | v < 6.1.6-15266 | 6.1.6-15266 |
| synology diskstation_manager | 5.2 ≤ v < 6.1.6-15266 | 6.1.6-15266 |
| synology vs960hd_firmware | v < 2.2.3-1505 | 2.2.3-1505 |
| netapp hci | No range specified | — |
| netapp solidfire | No range specified | — |
| hpe hpux-ntp | v < c.4.2.8.4.0 | c.4.2.8.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.