First published: Mon Mar 09 2020(Updated: )
NTP is vulnerable to a denial of service, caused by an issue when relying on unauthenticated IPv4 time sources in ntpd. By predicting transmit timestamps for use in spoofed packets, a remote attacker could exploit this vulnerability to cause the daemon to crash or system time change.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/ntp | <4.2.8 | 4.2.8 |
redhat/ntp | <4.3.100 | 4.3.100 |
IBM ISAM | <=9.0.7 | |
IBM Security Verify Access | <=10.0.0 | |
NTP ntp | <4.2.8 | |
NTP ntp | >=4.3.0<4.3.100 | |
NTP ntp | =4.2.8 | |
NTP ntp | =4.2.8-p1 | |
NTP ntp | =4.2.8-p1-beta1 | |
NTP ntp | =4.2.8-p1-beta2 | |
NTP ntp | =4.2.8-p1-beta3 | |
NTP ntp | =4.2.8-p1-beta4 | |
NTP ntp | =4.2.8-p1-beta5 | |
NTP ntp | =4.2.8-p1-rc1 | |
NTP ntp | =4.2.8-p1-rc2 | |
NTP ntp | =4.2.8-p10 | |
NTP ntp | =4.2.8-p11 | |
NTP ntp | =4.2.8-p12 | |
NTP ntp | =4.2.8-p13 | |
NTP ntp | =4.2.8-p2 | |
NTP ntp | =4.2.8-p2-rc1 | |
NTP ntp | =4.2.8-p2-rc2 | |
NTP ntp | =4.2.8-p2-rc3 | |
NTP ntp | =4.2.8-p3 | |
NTP ntp | =4.2.8-p3-rc1 | |
NTP ntp | =4.2.8-p3-rc2 | |
NTP ntp | =4.2.8-p3-rc3 | |
NTP ntp | =4.2.8-p4 | |
NTP ntp | =4.2.8-p5 | |
NTP ntp | =4.2.8-p6 | |
NTP ntp | =4.2.8-p7 | |
NTP ntp | =4.2.8-p8 | |
NTP ntp | =4.2.8-p9 | |
netapp cloud backup | ||
NetApp Clustered Data ONTAP | ||
NetApp Data ONTAP 7-Mode | ||
NetApp Element Software | ||
netapp hci management node | ||
netapp ontap tools vmware vsphere | ||
netapp solidfire | ||
NetApp SteelStore | ||
netapp hci compute node firmware | ||
netapp hci compute node | ||
netapp h410c firmware | ||
netapp h410c | ||
netapp h300s firmware | ||
netapp h300s | ||
NetApp H500S Firmware | ||
netapp h500s | ||
netapp h700s firmware | ||
netapp h700s | ||
netapp h300e firmware | ||
netapp h300e | ||
netapp h500e firmware | ||
netapp h500e | ||
netapp h700e firmware | ||
netapp h700e | ||
netapp h410s firmware | ||
netapp h410s | ||
openSUSE | =15.1 | |
openSUSE | =15.2 | |
Oracle Fujitsu M10-1 Firmware | <xcp2410 | |
Oracle Fujitsu M10-1 | ||
Oracle Fujitsu M10-4 Firmware | <xcp2410 | |
Oracle Fujitsu M10-4 | ||
fujitsu m10-4s firmware | <xcp2410 | |
fujitsu m10-4s | ||
Oracle Fujitsu M12-1 Firmware | <xcp2410 | |
Oracle Fujitsu M12-1 Firmware | ||
Oracle Fujitsu M12-2 Firmware | <xcp2410 | |
fujitsu m12-2 | ||
fujitsu m12-2s firmware | <xcp2410 | |
fujitsu m12-2s | ||
Oracle Fujitsu M10-4 Firmware | <xcp3110 | |
fujitsu m10-4s firmware | <xcp3110 | |
Oracle Fujitsu M12-1 Firmware | <xcp3110 | |
Oracle Fujitsu M12-2 Firmware | <xcp3110 | |
fujitsu m12-2s firmware | <xcp3110 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2020-13817 has a severity rating categorized as high due to its potential to cause a denial of service.
To fix CVE-2020-13817, update to NTP versions 4.2.8 or 4.3.100 or later, which have patched the vulnerability.
CVE-2020-13817 affects specific versions of NTP, including versions below 4.2.8 and between 4.3.0 and 4.3.100.
The exploit method for CVE-2020-13817 involves remote attackers predicting transmit timestamps to send spoofed packets.
The impact of CVE-2020-13817 includes the potential crashing of the NTP daemon and alteration of system time.