CVE-2020-11868 — HIGH (7.5)

Vulnerability Description

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Ntp	Ntp	<= 4.2.7
Redhat	Enterprise Linux	7.0
Netapp	Data Ontap	-
Netapp	Hci Management Node	-
Netapp	Solidfire	-
Netapp	Vasa Provider For Clustered Data Ontap	>= 7.2
Netapp	Virtual Storage Console	>= 7.2
Netapp	Clustered Data Ontap	-
Netapp	Hci Storage Node Firmware	-
Netapp	Hci Storage Node	-
Netapp	Fabric-Attached Storage 8300 Firmware	-
Netapp	Fabric-Attached Storage 8300	-
Netapp	Fabric-Attached Storage 8700 Firmware	-
Netapp	Fabric-Attached Storage 8700	-
Netapp	Fabric-Attached Storage A400 Firmware	-
Netapp	Fabric-Attached Storage A400	-
Netapp	All Flash Fabric-Attached Storage 8300 Firmware	-
Netapp	All Flash Fabric-Attached Storage 8300	-
Netapp	All Flash Fabric-Attached Storage 8700 Firmware	-
Netapp	All Flash Fabric-Attached Storage 8700	-

Related Weaknesses (CWE)

CWE-346

References

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.htmlMailing ListThird Party Advisory
http://support.ntp.org/bin/view/Main/NtpBug3592PatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1716665Issue TrackingThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00004.htmlMailing ListThird Party Advisory
https://security.gentoo.org/glsa/202007-12Third Party Advisory
https://security.netapp.com/advisory/ntap-20200424-0002/Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.htmlPatchThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.htmlMailing ListThird Party Advisory
http://support.ntp.org/bin/view/Main/NtpBug3592PatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1716665Issue TrackingThird Party Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00004.htmlMailing ListThird Party Advisory
https://security.gentoo.org/glsa/202007-12Third Party Advisory
https://security.netapp.com/advisory/ntap-20200424-0002/Third Party Advisory

FAQ

What is CVE-2020-11868?

CVE-2020-11868 is a vulnerability with a CVSS score of 7.5 (HIGH). ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissio...

How severe is CVE-2020-11868?

CVE-2020-11868 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-11868?

Check the references section above for vendor advisories and patch information. Affected products include: Ntp Ntp, Redhat Enterprise Linux, Netapp Data Ontap, Netapp Hci Management Node, Netapp Solidfire.