Home

CVE-2020-13817

Description

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victims ntpd instance.

Risk Information

Base Score
7.4
MODERATE
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS Score
Exploitation Probability
0.348

Associated Vulnerability

VulnerabilityOS Platform
(RHSA-2020:2663) ntp security update ntp-4.2.6p5-29.el7_8.2.x86_64.rpmLinux
(RHSA-2020:2663) ntp security update ntp-doc-4.2.6p5-29.el7_8.2.noarch.rpmLinux
(RHSA-2020:2663) ntp security update ntp-perl-4.2.6p5-29.el7_8.2.noarch.rpmLinux
(RHSA-2020:2663) ntp security update ntpdate-4.2.6p5-29.el7_8.2.x86_64.rpmLinux
(RHSA-2020:2663) ntp security update sntp-4.2.6p5-29.el7_8.2.x86_64.rpmLinux
SUSE-SU-2020:1805-1(SUSE Linux Enterprise Server 12-SP5) ntp-4.2.8p15-88.1.x86_64.rpmLinux
SUSE-SU-2020:1805-1(SUSE Linux Enterprise Server 12-SP5) ntp-debuginfo-4.2.8p15-88.1.x86_64.rpmLinux
SUSE-SU-2020:1805-1(SUSE Linux Enterprise Server 12-SP5) ntp-debugsource-4.2.8p15-88.1.x86_64.rpmLinux
SUSE-SU-2020:1805-1(SUSE Linux Enterprise Server 12-SP5) ntp-doc-4.2.8p15-88.1.x86_64.rpmLinux
(RHSA-2020:2663)Moderate: security update ntp-debuginfo-4.2.6p5-29.el7_8.2.x86_64.rpmLinux
Use of Insufficiently Random Values Vulnerability (CVE-2020-13817)NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234