7.4

CVE-2020-13817

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ntp ≫ Ntp Version < 4.2.8
Ntp ≫ Ntp Version >= 4.3.0 < 4.3.100
Ntp ≫ Ntp Version 4.2.8 Update -
Ntp ≫ Ntp Version 4.2.8 Update p1
Ntp ≫ Ntp Version 4.2.8 Update p1-beta1
Ntp ≫ Ntp Version 4.2.8 Update p1-beta2
Ntp ≫ Ntp Version 4.2.8 Update p1-beta3
Ntp ≫ Ntp Version 4.2.8 Update p1-beta4
Ntp ≫ Ntp Version 4.2.8 Update p1-beta5
Ntp ≫ Ntp Version 4.2.8 Update p1-rc1
Ntp ≫ Ntp Version 4.2.8 Update p1-rc2
Ntp ≫ Ntp Version 4.2.8 Update p10
Ntp ≫ Ntp Version 4.2.8 Update p11
Ntp ≫ Ntp Version 4.2.8 Update p12
Ntp ≫ Ntp Version 4.2.8 Update p13
Ntp ≫ Ntp Version 4.2.8 Update p2
Ntp ≫ Ntp Version 4.2.8 Update p2-rc1
Ntp ≫ Ntp Version 4.2.8 Update p2-rc2
Ntp ≫ Ntp Version 4.2.8 Update p2-rc3
Ntp ≫ Ntp Version 4.2.8 Update p3
Ntp ≫ Ntp Version 4.2.8 Update p3-rc1
Ntp ≫ Ntp Version 4.2.8 Update p3-rc2
Ntp ≫ Ntp Version 4.2.8 Update p3-rc3
Ntp ≫ Ntp Version 4.2.8 Update p4
Ntp ≫ Ntp Version 4.2.8 Update p5
Ntp ≫ Ntp Version 4.2.8 Update p6
Ntp ≫ Ntp Version 4.2.8 Update p7
Ntp ≫ Ntp Version 4.2.8 Update p8
Ntp ≫ Ntp Version 4.2.8 Update p9
Netapp ≫ Cloud Backup Version -
Netapp ≫ Data Ontap Version - SwPlatform 7-mode
Netapp ≫ Element Software Version -
Netapp ≫ Hci Management Node Version -
Netapp ≫ Ontap Tools Version - SwPlatform vmware_vsphere
Netapp ≫ Solidfire Version -
Netapp ≫ Hci Compute Node Firmware Version -
   Netapp ≫ Hci Compute Node Version -
Netapp ≫ H410c Firmware Version -
   Netapp ≫ H410c Version -
Netapp ≫ H300s Firmware Version -
   Netapp ≫ H300s Version -
Netapp ≫ H500s Firmware Version -
   Netapp ≫ H500s Version -
Netapp ≫ H700s Firmware Version -
   Netapp ≫ H700s Version -
Netapp ≫ H300e Firmware Version -
   Netapp ≫ H300e Version -
Netapp ≫ H500e Firmware Version -
   Netapp ≫ H500e Version -
Netapp ≫ H700e Firmware Version -
   Netapp ≫ H700e Version -
Netapp ≫ H410s Firmware Version -
   Netapp ≫ H410s Version -
Opensuse ≫ Leap Version 15.1
Opensuse ≫ Leap Version 15.2
Fujitsu ≫ M10-1 Firmware Version < xcp2410
   Fujitsu ≫ M10-1 Version -
Fujitsu ≫ M10-4 Firmware Version < xcp2410
   Fujitsu ≫ M10-4 Version -
Fujitsu ≫ M10-4s Firmware Version < xcp2410
   Fujitsu ≫ M10-4s Version -
Fujitsu ≫ M12-1 Firmware Version < xcp2410
   Fujitsu ≫ M12-1 Version -
Fujitsu ≫ M12-2 Firmware Version < xcp2410
   Fujitsu ≫ M12-2 Version -
Fujitsu ≫ M12-2s Firmware Version < xcp2410
   Fujitsu ≫ M12-2s Version -
Fujitsu ≫ M10-4 Firmware Version < xcp3110
   Fujitsu ≫ M10-4 Version -
Fujitsu ≫ M10-4s Firmware Version < xcp3110
   Fujitsu ≫ M10-4s Version -
Fujitsu ≫ M12-1 Firmware Version < xcp3110
   Fujitsu ≫ M12-1 Version -
Fujitsu ≫ M12-2 Firmware Version < xcp3110
   Fujitsu ≫ M12-2 Version -
Fujitsu ≫ M12-2s Firmware Version < xcp3110
   Fujitsu ≫ M12-2s Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.07% 0.894
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.4 2.2 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:N/I:P/A:P
CISA-ADP 7.4 2.2 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
MITRE 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

https://www.oracle.com/security-alerts/cpujan2022.html
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html
Third Party Advisory
Mailing List
https://security.gentoo.org/glsa/202007-12
Third Party Advisory
http://support.ntp.org/bin/view/Main/NtpBug3596
Vendor Advisory
https://bugs.ntp.org/show_bug.cgi?id=3596
Vendor Advisory
Issue Tracking
https://security.netapp.com/advisory/ntap-20200625-0004/
Third Party Advisory