PT-2019-6438 · Ntt+7 · Ntp+7
Published
2019-05-30
·
Updated
2025-05-05
·
CVE-2020-13817
CVSS v3.1
7.4
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ntp versions 4.2.8 through 4.2.8p14
ntp versions 4.3.x through 4.3.100
Description
The issue is related to the implementation of the NTP protocol, specifically with the use of insufficiently random values. This allows a remote attacker to cause a denial of service, either by exiting the daemon or changing the system time, by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources, and there must be an off-path attacker who can query time from the victim's ntpd instance.
Recommendations
For ntp versions 4.2.8 through 4.2.8p14, update to version 4.2.8p15 or later to resolve the issue.
For ntp versions 4.3.x through 4.3.100, update to version 4.3.101 or later to resolve the issue.
As a temporary workaround, consider restricting access to unauthenticated IPv4 time sources to minimize the risk of exploitation.
Fix
DoS
Use of Insufficiently Random Values
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Centos
Ibm Aix
Red Hat
Red Os
Suse
Ntp