CVE-2018-7170
CVSS 3.1 Score 5.3 of 10 (medium)
Details
Published Mar 6, 2018
Updated: Jan 14, 2025
Summary
CVE-2018-7170 is a vulnerability affecting the ntp service in versions 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92. It allows authenticated users with knowledge of the private symmetric key to create an excessive number of ephemeral associations. By doing so, they can manipulate the clock selection process of ntpd, initiating a Sybil attack and ultimately, modifying a victim's clock. This vulnerability is a result of an incomplete fix for a previously identified issue, CVE-2016-1549.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.