CVE-2018-12327Ntp Stack Buffer Overflow
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter.
Published Jun 20, 2018 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2018-12327, SUSE-SU-2018:3342-1, SUSE-SU-2018:3342-2, SUSE-SU-2018:3351-1, SUSE-SU-2018:3352-1, SUSE-SU-2018:3356-1, SUSE-SU-2018:3386-1, UBUNTU-CVE-2018-12327, USN-4229-1, USN-4229-2
Key Facts
Patch immediately- CVE-2018-12327 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Ntp, ntpdate (amazon), ntp-doc (amazon) and 4 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 28% probability of exploitation in the next 30 days.
- Fixed versions are available, including Ntp 0:4.2.6p5-15.el6_10, Ntp 0:4.2.6p5-29.el7, Ntp 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
28%
Higher than 98.0% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
52/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
3
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source.
Affected Products
92 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| NtpNtp | 4.2.8-p11 | 4.2.8.p12-1 |
| ntpdateamazon | See advisory | 4.2.8p12-1.39.amzn1 |
| ntp-docamazon | See advisory | 4.2.8p12-1.39.amzn1 |
| ntp-perlamazon | See advisory | 4.2.8p12-1.39.amzn1 |
| sntpamazon | See advisory | 4.2.6p5-29.amzn2.0.1 |
Patched Releases
Ntp
0:4.2.6p5-15.el6_10, 0:4.2.6p5-29.el7, 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1, 1:4.2.8p10+dfsg-5ubuntu7.3+esm1, 1:4.2.8p4+dfsg-3ubuntu5.10, 4.2.6p5-15.0.1.el6_10, 4.2.6p5-29.0.1.el7, 4.2.6p5-29.amzn2.0.1, 4.2.8.p12-1, 4.2.8p12-1.39.amzn1, 4.2.8p12-1.ph1, 4.2.8p12-1.ph2, 4.2.8p12-31.6.1, 4.2.8p12-4.3.2, 4.2.8p12-46.29.2, 4.2.8p12-48.21.1, 4.2.8p12-64.7.1, 4.2.8p12-64.8.2, 4.2.8p12-lp150.3.3.1, 4.2.8p15-7.2, NA
ntp-dcf77-tools
4.2.8p15-7.2
ntp-doc
4.2.6p5-15.0.1.el6_10, 4.2.6p5-29.0.1.el7, 4.2.6p5-29.amzn2.0.1, 4.2.8p12-1.39.amzn1, 4.2.8p12-31.6.1, 4.2.8p12-46.29.2, 4.2.8p12-48.21.1, 4.2.8p12-64.7.1, 4.2.8p12-64.8.2, 4.2.8p12-lp150.3.3.1, 4.2.8p15-7.2
ntp-perl
4.2.6p5-15.0.1.el6_10, 4.2.6p5-29.0.1.el7, 4.2.6p5-29.amzn2.0.1, 4.2.8p12-1.39.amzn1, NA
ntpdate
4.2.6p5-15.0.1.el6_10, 4.2.6p5-29.0.1.el7, 4.2.6p5-29.amzn2.0.1, 4.2.8p12-1.39.amzn1
ntpstat
NA
sntp
4.2.6p5-29.0.1.el7, 4.2.6p5-29.amzn2.0.1
Timeline
Publicly disclosed
Jun 20, 2018
Last updated
Aug 4, 2026
Weakness Type
- CWE-121 Stack-based Buffer Overflow
- CWE-787 Out-of-bounds Write
References
- advisorysecurity-tracker.debian.org · CVE-2018-12327
- advisoryubuntu.com · CVE-2018-12327
- advisorycve.org · CVERecord
- advisoryRHSA-2020:1470
- advisorybugzilla.suse.com · 1083424
FAQ
Common Questions.
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter.
Affected: Ntp versions 4.2.8-p11; ntpdate (amazon); ntp-doc (amazon), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Ntp 0:4.2.6p5-15.el6_10, Ntp 0:4.2.6p5-29.el7, Ntp 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13+esm1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2018-12327 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo