CVE-2020-11868

Published: Apr 17, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.

Affected (47)

Products: Ntp: Ntp · Redhat: Enterprise Linux · Netapp: Clustered Data Ontap, Data Ontap, Hci Management Node, Solidfire, Vasa Provider For Clustered Data Ontap, Virtual Storage Console, Hci Storage Node Firmware, Fabric Attached Storage 8300 Firmware, Fabric Attached Storage 8700 Firmware, Fabric Attached Storage A400 Firmware, All Flash Fabric Attached Storage 8300 Firmware, All Flash Fabric Attached Storage 8700 Firmware, All Flash Fabric Attached Storage A400 Firmware · +2 more

Show all products

1 product

1 product

13 products

Vasa Provider For Clustered Data Ontap

Virtual Storage Console

Hci Storage Node Firmware

Fabric Attached Storage 8300 Firmware

Fabric Attached Storage 8700 Firmware

Fabric Attached Storage A400 Firmware

All Flash Fabric Attached Storage 8300 Firmware

All Flash Fabric Attached Storage 8700 Firmware

All Flash Fabric Attached Storage A400 Firmware

1 product

1 product

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Ntp Ntp	Up to 4.2.7
Ntp Ntp	From 4.3.98 to 4.3.100
Ntp Ntp	Version 4.2.8
Ntp Ntp	Version 4.2.8 p1-beta1
Ntp Ntp	Version 4.2.8 p1-beta2
Ntp Ntp	Version 4.2.8 p1-beta3
Ntp Ntp	Version 4.2.8 p1-beta4
Ntp Ntp	Version 4.2.8 p1-beta5
Ntp Ntp	Version 4.2.8 p1-rc1
Ntp Ntp	Version 4.2.8 p1-rc2
Ntp Ntp	Version 4.2.8 p10
Ntp Ntp	Version 4.2.8 p11
Ntp Ntp	Version 4.2.8 p12
Ntp Ntp	Version 4.2.8 p13
Ntp Ntp	Version 4.2.8 p1
Ntp Ntp	Version 4.2.8 p2-rc1
Ntp Ntp	Version 4.2.8 p2-rc2
Ntp Ntp	Version 4.2.8 p2-rc3
Ntp Ntp	Version 4.2.8 p2
Ntp Ntp	Version 4.2.8 p3-rc1
Ntp Ntp	Version 4.2.8 p3-rc2
Ntp Ntp	Version 4.2.8 p3-rc3
Ntp Ntp	Version 4.2.8 p3
Ntp Ntp	Version 4.2.8 p4
Ntp Ntp	Version 4.2.8 p5
Ntp Ntp	Version 4.2.8 p6
Ntp Ntp	Version 4.2.8 p7
Ntp Ntp	Version 4.2.8 p8
Ntp Ntp	Version 4.2.8 p9

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 7.0

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Netapp Clustered Data Ontap	All versions
Netapp Data Ontap	All versions
Netapp Hci Management Node	All versions
Netapp Solidfire	All versions
Netapp Vasa Provider For Clustered Data Ontap	From 7.2
Netapp Vasa Provider For Clustered Data Ontap	From 7.2
Netapp Virtual Storage Console	From 7.2

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Hci Storage Node Firmware	All versions

Running on/with	Platform Versions
Netapp Hci Storage Node	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fabric Attached Storage 8300 Firmware	All versions

Running on/with	Platform Versions
Netapp Fabric Attached Storage 8300	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fabric Attached Storage 8700 Firmware	All versions

Running on/with	Platform Versions
Netapp Fabric Attached Storage 8700	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fabric Attached Storage A400 Firmware	All versions

Running on/with	Platform Versions
Netapp Fabric Attached Storage A400	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp All Flash Fabric Attached Storage 8300 Firmware	All versions

Running on/with	Platform Versions
Netapp All Flash Fabric Attached Storage 8300	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp All Flash Fabric Attached Storage 8700 Firmware	All versions

Running on/with	Platform Versions
Netapp All Flash Fabric Attached Storage 8700	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp All Flash Fabric Attached Storage A400 Firmware	All versions

Running on/with	Platform Versions
Netapp All Flash Fabric Attached Storage A400	All versions

Configuration K

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration L

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Related CWEs

CWE-346

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References (16)

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://support.ntp.org/bin/view/Main/NtpBug3592

Source: cve@mitre.org

PatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1716665

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/05/msg00004.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202007-12

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200424-0002/

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: cve@mitre.org

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html