Vulnerability Details : CVE-2020-13817
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
Vulnerability category: Denial of service
Products affected by CVE-2020-13817
- cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p4:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p5:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p6:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p7:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p8:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p9:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p11:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p10:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p12:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.8:p13:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:*
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:a:netapp:ontap_tools:-:*:*:*:*:vmware_vsphere:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-13817
5.90%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-13817
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:P |
8.6
|
4.9
|
NIST | |
5.9
|
MEDIUM | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
2.2
|
3.6
|
MITRE | |
7.4
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H |
2.2
|
5.2
|
NIST |
CWE ids for CVE-2020-13817
-
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-13817
-
https://www.oracle.com/security-alerts/cpujan2022.html
Oracle Critical Patch Update Advisory - January 2022Patch;Third Party Advisory
-
https://security.netapp.com/advisory/ntap-20200625-0004/
CVE-2020-13817 NTP Vulnerability in NetApp Products | NetApp Product SecurityThird Party Advisory
-
http://support.ntp.org/bin/view/Main/NtpBug3596
NtpBug3596 < Main < NTPVendor Advisory
-
https://bugs.ntp.org/show_bug.cgi?id=3596
Bug 3596 – ntpd uses highly predictable transmit timestampsIssue Tracking;Vendor Advisory
-
https://security.gentoo.org/glsa/202007-12
NTP: Multiple vulnerabilities (GLSA 202007-12) — Gentoo securityThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html
[security-announce] openSUSE-SU-2020:0934-1: moderate: Security update fMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html
[security-announce] openSUSE-SU-2020:1007-1: moderate: Security update fMailing List;Third Party Advisory
Jump to