PT-2019-6080 · Ntp · Network Time Protocol

Publicado 2019-04-16 · Atualizado 2020-08-24 · CVE-2019-11331

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Network Time Protocol (NTP) (affected versions not specified)

Description The issue is related to insufficient protection of service data during port randomization in the Network Time Protocol (NTP). This can be exploited by a remote attacker to cause a denial of service by connecting through port 123. The protocol's use of port 123, as specified in RFC 5905, even in modes where a fixed port number is not required, makes it easier for remote attackers to conduct off-path attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-254

CWE-200

Identificadores relacionados

BDU:2021-04789

CVE-2019-11331

Produtos afetados

Network Time Protocol

Referências · 8

• https://tools.ietf.org/html/draft-gont-ntp-port-randomization-00 · Nota
• https://vuldb.com/?id.133843 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11331 · Nota de Segurança
• https://bdu.fstec.ru/vul/2021-04789 · Nota de Segurança
• https://support.f5.com/csp/article/K09940637 · Nota
• https://support.f5.com/csp/article/K09940637?utm_source=f5support&utm_medium=RSS · Nota
• http://securityfocus.com/bid/108010 · Nota
• https://support.f5.com/csp/article/K09940637?utm_source=f5support&amp%3Butm_medium=RSS · Nota