ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
References
| Link | Resource |
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html | Mailing List Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html | Mailing List Third Party Advisory |
| http://support.ntp.org/bin/view/Main/NtpBug3596 | Vendor Advisory |
| https://bugs.ntp.org/show_bug.cgi?id=3596 | Issue Tracking Vendor Advisory |
| https://security.gentoo.org/glsa/202007-12 | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20200625-0004/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujan2022.html | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
Configuration 9 (hide)
| AND |
|
Configuration 10 (hide)
| AND |
|
Configuration 11 (hide)
| AND |
|
Configuration 12 (hide)
|
Configuration 13 (hide)
| AND |
|
Configuration 14 (hide)
| AND |
|
Configuration 15 (hide)
| AND |
|
Configuration 16 (hide)
| AND |
|
Configuration 17 (hide)
| AND |
|
Configuration 18 (hide)
| AND |
|
Configuration 19 (hide)
| AND |
|
Configuration 20 (hide)
| AND |
|
Configuration 21 (hide)
| AND |
|
Configuration 22 (hide)
| AND |
|
Configuration 23 (hide)
| AND |
|
History
29 Mar 2022, 18:05
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:fujitsu:m12-1:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:* cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* cpe:2.3:h:fujitsu:m12-2s:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:fujitsu:m10-4:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* cpe:2.3:h:fujitsu:m10-1:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:ontap_tools:-:*:*:*:*:vmware_vsphere:*:* cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:* cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* cpe:2.3:h:fujitsu:m10-4s:-:*:*:*:*:*:*:* cpe:2.3:h:fujitsu:m12-2:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:* |
|
| First Time |
Fujitsu m10-1 Firmware
Fujitsu m12-2 Firmware Netapp ontap Tools Netapp hci Compute Node Firmware Netapp h410c Fujitsu m10-1 Netapp h700s Netapp Netapp h500e Firmware Netapp h300e Firmware Netapp h500s Firmware Fujitsu m12-1 Firmware Fujitsu m12-2s Netapp h300s Firmware Netapp h500e Netapp h700e Opensuse Netapp hci Compute Node Fujitsu m12-2 Netapp hci Management Node Fujitsu m12-2s Firmware Netapp h300e Fujitsu m10-4 Netapp h410s Fujitsu m10-4s Netapp h410s Firmware Netapp h410c Firmware Netapp clustered Data Ontap Netapp h700e Firmware Fujitsu m10-4s Firmware Netapp data Ontap Fujitsu m10-4 Firmware Netapp cloud Backup Netapp h700s Firmware Fujitsu Netapp element Software Opensuse leap Netapp steelstore Cloud Integrated Storage Netapp h500s Fujitsu m12-1 Netapp solidfire Netapp h300s |
|
| References | (MISC) https://www.oracle.com/security-alerts/cpujan2022.html - Patch, Third Party Advisory | |
| References | (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html - Mailing List, Third Party Advisory | |
| References | (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html - Mailing List, Third Party Advisory | |
| References | (GENTOO) https://security.gentoo.org/glsa/202007-12 - Third Party Advisory | |
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20200625-0004/ - Third Party Advisory |
07 Feb 2022, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-330 | |
| References |
|
Information
Published : 2020-06-04 13:15
Updated : 2023-12-10 13:27
NVD link : CVE-2020-13817
Mitre link : CVE-2020-13817
CVE.ORG link : CVE-2020-13817
JSON object : View
Products Affected
netapp
- h700s_firmware
- h700e
- element_software
- hci_management_node
- clustered_data_ontap
- hci_compute_node
- h700e_firmware
- h700s
- h300s_firmware
- cloud_backup
- steelstore_cloud_integrated_storage
- hci_compute_node_firmware
- h300s
- h300e
- h500e_firmware
- data_ontap
- h410c_firmware
- h410c
- h500s
- h410s
- ontap_tools
- h410s_firmware
- solidfire
- h500s_firmware
- h300e_firmware
- h500e
fujitsu
- m10-4
- m12-2s
- m10-4s_firmware
- m12-2s_firmware
- m12-2_firmware
- m12-1
- m10-1
- m10-4s
- m10-1_firmware
- m10-4_firmware
- m12-1_firmware
- m12-2
opensuse
- leap
ntp
- ntp
CWE
CWE-330
Use of Insufficiently Random Values