ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)
- CVSS 3.0 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade sntpUpgrade ntpdateUpgrade ntpUpgrade ntp-perlUpgrade ntp-docUpgrade ntp-debuginfo | Jul 21, 2020 | Jun 4, 2020 |
| Centos_linux | — | Upgrade ntpdateUpgrade ntpUpgrade sntpUpgrade ntp-perlUpgrade ntp-docUpgrade ntp-debuginfo | Jun 24, 2020 | Jun 4, 2020 |
| Debian | — | Upgrade ntp | Jul 30, 2024 | Jun 4, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 9, 2020 |
| Gentoo Linux | — | Upgrade net-misc/ntp. | Jul 28, 2020 | Jun 4, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ntpUpgrade ntpdate | Nov 3, 2020 | Jun 4, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ntpUpgrade sntpUpgrade ntpdate | Sep 3, 2020 | Jun 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade ntpdateUpgrade ntpUpgrade sntp | Jul 31, 2020 | Jun 4, 2020 |
| Ibm Aix | — | Apply the fix or workaround for ntp_advisory13 | Oct 27, 2020 | Jun 4, 2020 |
| Ntp | — | Upgrade NTP to version 4.3.100Upgrade NTP to version 4.2.8 | Feb 23, 2023 | Jun 4, 2020 |
| Oracle Solaris | — | Upgrade service/network/ntp to version 4.2.8.14-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Jun 4, 2020 |
| Oracle_linux | — | Upgrade sntpUpgrade ntpUpgrade ntpdateUpgrade ntp-perlUpgrade ntp-doc | Jun 24, 2020 | Mar 3, 2020 |
| Redhat_linux | — | Upgrade ntpNo solution existsUpgrade ntp-perlUpgrade ntp-docUpgrade sntpUpgrade ntp-debuginfoUpgrade ntpdate | Jun 24, 2020 | Jun 4, 2020 |
| Suse | — | Upgrade ntpUpgrade ntp-doc | Jul 1, 2020 | Jun 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub