Skip to content
OpenAdvisories
Low ALAS2-2019-1367 1 CVE

Low: ntp security update (Amazon Linux 2)

Published Nov 19, 2019 · Updated Nov 22, 2019

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-12327: The ntpq and ntpdc command-line utilities that are part of ntp package are vulnerable to stack-based buffer overflow via crafted hostname. Applications using these vulnerable utilities with an untrusted input may be potentially exploited, resulting in a crash or arbitrary code execution under privileges of that application. 1593580: CVE-2018-12327 ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 ntp 0:4.2.6p5-29.amzn2.0.1
Amazon Linux · 2 ntp-debuginfo 0:4.2.6p5-29.amzn2.0.1
Amazon Linux · 2 ntp-doc 0:4.2.6p5-29.amzn2.0.1
Amazon Linux · 2 ntp-perl 0:4.2.6p5-29.amzn2.0.1
Amazon Linux · 2 ntpdate 0:4.2.6p5-29.amzn2.0.1
Amazon Linux · 2 sntp 0:4.2.6p5-29.amzn2.0.1

Vulnerabilities 1

  • Unscored —
    CVE-2018-12327 Public exploit EPSS 28%

    Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or e…

    ntp ntp Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-12327.html