CVE-2020-13817

Katalog CVE

CVSS 7.4 · High EPSS 3,3%

Kerentanan Use of Insufficiently Random Values pada ntp, netapp cloud backup +23 lainnya. Skor CVSS 3.1 7.4 (High) menurut NVD.

Deskripsi (NVD)

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.

Rincian

Terbit di NVD

4 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.4 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-330: Use of Insufficiently Random Values

EPSS (30 hari)

3,3% peluang dieksploitasi; lebih tinggi dari 88,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://support.ntp.org/bin/view/Main/NtpBug3596 advisory vendor
• https://bugs.ntp.org/show_bug.cgi?id=3596 issue tracking · advisory vendor
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202007-12 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200625-0004/ advisory pihak ketiga