PT-2019-6438 · Ntt+7 · Ntp+7
Publicado
2019-05-30
·
Atualizado
2025-05-05
·
CVE-2020-13817
CVSS v3.1
7.4
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ntp versions 4.2.8 through 4.2.8p14
ntp versions 4.3.x through 4.3.100
Description
The issue is related to the implementation of the NTP protocol, specifically with the use of insufficiently random values. This allows a remote attacker to cause a denial of service, either by exiting the daemon or changing the system time, by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources, and there must be an off-path attacker who can query time from the victim's ntpd instance.
Recommendations
For ntp versions 4.2.8 through 4.2.8p14, update to version 4.2.8p15 or later to resolve the issue.
For ntp versions 4.3.x through 4.3.100, update to version 4.3.101 or later to resolve the issue.
As a temporary workaround, consider restricting access to unauthenticated IPv4 time sources to minimize the risk of exploitation.
Correção
DoS
Use of Insufficiently Random Values
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Centos
Ibm Aix
Red Hat
Red Os
Suse
Ntp