PT-2019-6080 · Ntp · Network Time Protocol

Published 2019-04-16 · Updated 2020-08-24 · CVE-2019-11331

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Network Time Protocol (NTP) (affected versions not specified)

Description The issue is related to insufficient protection of service data during port randomization in the Network Time Protocol (NTP). This can be exploited by a remote attacker to cause a denial of service by connecting through port 123. The protocol's use of port 123, as specified in RFC 5905, even in modes where a fixed port number is not required, makes it easier for remote attackers to conduct off-path attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-254

CWE-200

Related Identifiers

BDU:2021-04789

CVE-2019-11331

Affected Products

Network Time Protocol

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2019-11331 · Security Note
• https://bdu.fstec.ru/vul/2021-04789 · Security Note
• https://tools.ietf.org/html/draft-gont-ntp-port-randomization-00 · Note
• https://vuldb.com/?id.133843 · Note
• https://support.f5.com/csp/article/K09940637 · Note
• https://support.f5.com/csp/article/K09940637?utm_source=f5support&utm_medium=RSS · Note
• http://securityfocus.com/bid/108010 · Note
• https://support.f5.com/csp/article/K09940637?utm_source=f5support&amp%3Butm_medium=RSS · Note