CVE-2020-13817

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 04-06-2020 03:15

Last modified: - 29-03-2022 08:05

Total changes: - 4

Description

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

High

Attack complexity

Network

Attack vector

High

Availability

None

Confidentiality

High

Integrity

None

Privileges required

Unchanged

Scope

None

User interaction

7.4

Base score

2.2

5.2

Exploitability score

Impact score

Verification logic

vendor=ntp AND product=ntp AND versionEndExcluding=4.2.8

vendor=ntp AND product=ntp AND version=4.2.8 AND update=-

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p1

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p1-beta1

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p1-beta2

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p1-beta3

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p1-beta4

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p1-beta5

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p1-rc1

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p1-rc2

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p10

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p11

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p12

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p13

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p2

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p2-rc1

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p2-rc2

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p2-rc3

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p3

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p3-rc1

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p3-rc2

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p3-rc3

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p4

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p5

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p6

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p7

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p8

vendor=ntp AND product=ntp AND version=4.2.8 AND update=p9

vendor=ntp AND product=ntp AND versionStartIncluding=4.3.0 AND versionEndExcluding=4.3.100

vendor=netapp AND product=cloud_backup AND version=-

vendor=netapp AND product=clustered_data_ontap AND version=-

vendor=netapp AND product=data_ontap AND version=- AND target_software=7-mode

vendor=netapp AND product=element_software AND version=-

vendor=netapp AND product=hci_management_node AND version=-

vendor=netapp AND product=ontap_tools AND version=- AND target_software=vmware_vsphere

vendor=netapp AND product=solidfire AND version=-

vendor=netapp AND product=steelstore_cloud_integrated_storage AND version=-

AND

vendor=netapp AND product=hci_compute_node_firmware AND version=-

vendor=netapp AND product=hci_compute_node AND version=-

AND

vendor=netapp AND product=h410c_firmware AND version=-

vendor=netapp AND product=h410c AND version=-

AND

vendor=netapp AND product=h300s_firmware AND version=-

vendor=netapp AND product=h300s AND version=-

AND

vendor=netapp AND product=h500s_firmware AND version=-

vendor=netapp AND product=h500s AND version=-

AND

vendor=netapp AND product=h700s_firmware AND version=-

vendor=netapp AND product=h700s AND version=-

AND

vendor=netapp AND product=h300e_firmware AND version=-

vendor=netapp AND product=h300e AND version=-

AND

vendor=netapp AND product=h500e_firmware AND version=-

vendor=netapp AND product=h500e AND version=-

AND

vendor=netapp AND product=h700e_firmware AND version=-

vendor=netapp AND product=h700e AND version=-

AND

vendor=netapp AND product=h410s_firmware AND version=-

vendor=netapp AND product=h410s AND version=-

vendor=opensuse AND product=leap AND version=15.1

vendor=opensuse AND product=leap AND version=15.2

AND

vendor=fujitsu AND product=m10-1_firmware AND versionEndExcluding=xcp2410

vendor=fujitsu AND product=m10-1 AND version=-

AND

vendor=fujitsu AND product=m10-4_firmware AND versionEndExcluding=xcp2410

vendor=fujitsu AND product=m10-4 AND version=-

AND

vendor=fujitsu AND product=m10-4s_firmware AND versionEndExcluding=xcp2410

vendor=fujitsu AND product=m10-4s AND version=-

AND

vendor=fujitsu AND product=m12-1_firmware AND versionEndExcluding=xcp2410

vendor=fujitsu AND product=m12-1 AND version=-

AND

vendor=fujitsu AND product=m12-2_firmware AND versionEndExcluding=xcp2410

vendor=fujitsu AND product=m12-2 AND version=-

AND

vendor=fujitsu AND product=m12-2s_firmware AND versionEndExcluding=xcp2410

vendor=fujitsu AND product=m12-2s AND version=-

AND

vendor=fujitsu AND product=m10-4_firmware AND versionEndExcluding=xcp3110

vendor=fujitsu AND product=m10-4 AND version=-

AND

vendor=fujitsu AND product=m10-4s_firmware AND versionEndExcluding=xcp3110

vendor=fujitsu AND product=m10-4s AND version=-

AND

vendor=fujitsu AND product=m12-1_firmware AND versionEndExcluding=xcp3110

vendor=fujitsu AND product=m12-1 AND version=-

AND

vendor=fujitsu AND product=m12-2_firmware AND versionEndExcluding=xcp3110

vendor=fujitsu AND product=m12-2 AND version=-

AND

vendor=fujitsu AND product=m12-2s_firmware AND versionEndExcluding=xcp3110

vendor=fujitsu AND product=m12-2s AND version=-

Reference

http://support.ntp.org/bin/view/Main/NtpBug3596
https://bugs.ntp.org/show_bug.cgi?id=3596
https://security.netapp.com/advisory/ntap-20200625-0004/
openSUSE-SU-2020:0934-Mailing List, Third Party Advisory
openSUSE-SU-2020:1007-Mailing List, Third Party Advisory
GLSA-202007-12-Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html

Keywords

CVE-2020-13817

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2020-13817

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures