CVE-2020-13817

Published: Jun 4, 2020Modified: Jun 17, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 2.2 / Impact: 5.2

Source: NVD

Description

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.

Affected (59)

Products: Ntp: Ntp · Netapp: Cloud Backup, Clustered Data Ontap, Data Ontap, Element Software, Hci Management Node, Ontap Tools, Solidfire, Steelstore Cloud Integrated Storage, Hci Compute Node Firmware, H410c Firmware, H300s Firmware, H500s Firmware, H700s Firmware, H300e Firmware, H500e Firmware, H700e Firmware, H410s Firmware · Opensuse: Leap · +1 more

Show all products

1 product

17 products

Steelstore Cloud Integrated Storage

Hci Compute Node Firmware

1 product

6 products

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Ntp Ntp	Before 4.2.8
Ntp Ntp	From 4.3.0 to 4.3.100
Ntp Ntp	Version 4.2.8
Ntp Ntp	Version 4.2.8 p1-beta1
Ntp Ntp	Version 4.2.8 p1-beta2
Ntp Ntp	Version 4.2.8 p1-beta3
Ntp Ntp	Version 4.2.8 p1-beta4
Ntp Ntp	Version 4.2.8 p1-beta5
Ntp Ntp	Version 4.2.8 p1-rc1
Ntp Ntp	Version 4.2.8 p1-rc2
Ntp Ntp	Version 4.2.8 p10
Ntp Ntp	Version 4.2.8 p11
Ntp Ntp	Version 4.2.8 p12
Ntp Ntp	Version 4.2.8 p13
Ntp Ntp	Version 4.2.8 p1
Ntp Ntp	Version 4.2.8 p2-rc1
Ntp Ntp	Version 4.2.8 p2-rc2
Ntp Ntp	Version 4.2.8 p2-rc3
Ntp Ntp	Version 4.2.8 p2
Ntp Ntp	Version 4.2.8 p3-rc1
Ntp Ntp	Version 4.2.8 p3-rc2
Ntp Ntp	Version 4.2.8 p3-rc3
Ntp Ntp	Version 4.2.8 p3
Ntp Ntp	Version 4.2.8 p4
Ntp Ntp	Version 4.2.8 p5
Ntp Ntp	Version 4.2.8 p6
Ntp Ntp	Version 4.2.8 p7
Ntp Ntp	Version 4.2.8 p8
Ntp Ntp	Version 4.2.8 p9

Configuration B

8 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions
Netapp Clustered Data Ontap	All versions
Netapp Data Ontap	All versions
Netapp Element Software	All versions
Netapp Hci Management Node	All versions
Netapp Ontap Tools	All versions
Netapp Solidfire	All versions
Netapp Steelstore Cloud Integrated Storage	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Hci Compute Node Firmware	All versions

Running on/with	Platform Versions
Netapp Hci Compute Node	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410c Firmware	All versions

Running on/with	Platform Versions
Netapp H410c	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300s Firmware	All versions

Running on/with	Platform Versions
Netapp H300s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500s Firmware	All versions

Running on/with	Platform Versions
Netapp H500s	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700s Firmware	All versions

Running on/with	Platform Versions
Netapp H700s	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H300e Firmware	All versions

Running on/with	Platform Versions
Netapp H300e	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H500e Firmware	All versions

Running on/with	Platform Versions
Netapp H500e	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H700e Firmware	All versions

Running on/with	Platform Versions
Netapp H700e	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp H410s Firmware	All versions

Running on/with	Platform Versions
Netapp H410s	All versions

Configuration L

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 1 Firmware	Before xcp2410

Running on/with	Platform Versions
Fujitsu M10 1	All versions

Configuration N

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 4 Firmware	Before xcp2410

Configuration O

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 4s Firmware	Before xcp2410

Configuration P

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 1 Firmware	Before xcp2410

Configuration Q

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 2 Firmware	Before xcp2410

Configuration R

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 2s Firmware	Before xcp2410

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M10 4	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4s Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M10 4s	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 1 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 1	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 2	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2s Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 2s	All versions

Related CWEs

CWE-330

Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

References (14)

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://support.ntp.org/bin/view/Main/NtpBug3596

Source: cve@mitre.org

Vendor Advisory

https://bugs.ntp.org/show_bug.cgi?id=3596

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://security.gentoo.org/glsa/202007-12

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200625-0004/

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: cve@mitre.org

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html