ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)
- CVSS 3.0 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ntp-debuginfoUpgrade ntp-docUpgrade ntpdateUpgrade sntpUpgrade ntpUpgrade ntp-perl | Jul 21, 2020 | Jun 4, 2020 |
| Centos_linux | — | Upgrade ntp-perlUpgrade ntp-docUpgrade ntp-debuginfoUpgrade sntpUpgrade ntpUpgrade ntpdate | Jun 24, 2020 | Jun 4, 2020 |
| Debian | — | Upgrade ntp | Jul 30, 2024 | Jun 4, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 9, 2020 |
| Gentoo Linux | — | Upgrade net-misc/ntp. | Jul 28, 2020 | Jun 4, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ntpUpgrade ntpdate | Nov 3, 2020 | Jun 4, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ntpUpgrade ntpdateUpgrade sntp | Sep 3, 2020 | Jun 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade sntpUpgrade ntpdateUpgrade ntp | Jul 31, 2020 | Jun 4, 2020 |
| Ibm Aix | — | Apply the fix or workaround for ntp_advisory13 | Oct 27, 2020 | Jun 4, 2020 |
| Ntp | — | Upgrade NTP to version 4.2.8Upgrade NTP to version 4.3.100 | Feb 23, 2023 | Jun 4, 2020 |
| Oracle Solaris | — | Upgrade service/network/ntp to version 4.2.8.14-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Jun 4, 2020 |
| Oracle_linux | — | Upgrade sntpUpgrade ntpUpgrade ntp-docUpgrade ntp-perlUpgrade ntpdate | Jun 24, 2020 | Mar 3, 2020 |
| Redhat_linux | — | No solution existsUpgrade ntp-docUpgrade ntpUpgrade ntp-perlUpgrade ntpdateUpgrade ntp-debuginfoUpgrade sntp | Jun 24, 2020 | Jun 4, 2020 |
| Suse | — | Upgrade ntpUpgrade ntp-doc | Jul 1, 2020 | Jun 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub