First published: Mon Mar 09 2020(Updated: )
NTP is vulnerable to a denial of service, caused by an issue when relying on unauthenticated IPv4 time sources in ntpd. By predicting transmit timestamps for use in spoofed packets, a remote attacker could exploit this vulnerability to cause the daemon to crash or system time change.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/ntp | <4.2.8 | 4.2.8 |
redhat/ntp | <4.3.100 | 4.3.100 |
IBM Security Access Manager | <=9.0.7 | |
IBM Security Verify Access OIDC Provider | <=10.0.0 | |
NTP | <4.2.8 | |
NTP | >=4.3.0<4.3.100 | |
NTP | =4.2.8 | |
NTP | =4.2.8-p1 | |
NTP | =4.2.8-p1-beta1 | |
NTP | =4.2.8-p1-beta2 | |
NTP | =4.2.8-p1-beta3 | |
NTP | =4.2.8-p1-beta4 | |
NTP | =4.2.8-p1-beta5 | |
NTP | =4.2.8-p1-rc1 | |
NTP | =4.2.8-p1-rc2 | |
NTP | =4.2.8-p10 | |
NTP | =4.2.8-p11 | |
NTP | =4.2.8-p12 | |
NTP | =4.2.8-p13 | |
NTP | =4.2.8-p2 | |
NTP | =4.2.8-p2-rc1 | |
NTP | =4.2.8-p2-rc2 | |
NTP | =4.2.8-p2-rc3 | |
NTP | =4.2.8-p3 | |
NTP | =4.2.8-p3-rc1 | |
NTP | =4.2.8-p3-rc2 | |
NTP | =4.2.8-p3-rc3 | |
NTP | =4.2.8-p4 | |
NTP | =4.2.8-p5 | |
NTP | =4.2.8-p6 | |
NTP | =4.2.8-p7 | |
NTP | =4.2.8-p8 | |
NTP | =4.2.8-p9 | |
NetApp Cloud Backup | ||
IBM Data ONTAP | ||
IBM Data ONTAP | ||
NetApp Management Services for Element Software | ||
NetApp SolidFire & HCI Management Node | ||
NetApp ONTAP Tools for VMware vSphere | ||
NetApp SolidFire & HCI Storage Node | ||
NetApp SteelStore Cloud Integrated Storage | ||
NetApp HCI Compute Node Firmware | ||
NetApp HCI Compute Node | ||
NetApp H410C | ||
NetApp H410C Firmware | ||
NetApp H300S Firmware | ||
NetApp H300S Firmware | ||
NetApp H500e Firmware | ||
NetApp H500e Firmware | ||
NetApp H700S | ||
NetApp H700S | ||
NetApp H300E | ||
NetApp H300E Firmware | ||
NetApp H500S Firmware | ||
NetApp H500e Firmware | ||
NetApp H700E | ||
NetApp H700E | ||
NetApp H410S | ||
NetApp H410S Firmware | ||
SUSE Linux | =15.1 | |
SUSE Linux | =15.2 | |
Oracle Fujitsu M10-1 Firmware | <xcp2410 | |
Oracle Fujitsu M10-1 | ||
Oracle Fujitsu M10-4 Firmware | <xcp2410 | |
Oracle Fujitsu M10-4 | ||
Oracle Fujitsu M10-4S Firmware | <xcp2410 | |
Fujitsu M10-4S | ||
Oracle Fujitsu M12-1 Firmware | <xcp2410 | |
Oracle Fujitsu M12-1 Firmware | ||
Oracle Fujitsu M12-2 Firmware | <xcp2410 | |
Fujitsu SPARC M12-2 | ||
Fujitsu SPARC M12-2S | <xcp2410 | |
Fujitsu SPARC M12-2S | ||
Oracle Fujitsu M10-4 Firmware | <xcp3110 | |
Oracle Fujitsu M10-4S Firmware | <xcp3110 | |
Oracle Fujitsu M12-1 Firmware | <xcp3110 | |
Oracle Fujitsu M12-2 Firmware | <xcp3110 | |
Fujitsu SPARC M12-2S | <xcp3110 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2020-13817 has a severity rating categorized as high due to its potential to cause a denial of service.
To fix CVE-2020-13817, update to NTP versions 4.2.8 or 4.3.100 or later, which have patched the vulnerability.
CVE-2020-13817 affects specific versions of NTP, including versions below 4.2.8 and between 4.3.0 and 4.3.100.
The exploit method for CVE-2020-13817 involves remote attackers predicting transmit timestamps to send spoofed packets.
The impact of CVE-2020-13817 includes the potential crashing of the NTP daemon and alteration of system time.