Name: CVE-2020-13817: Use of Insufficiently Random Values
Creator: Rapid7
Published: 2020-06-04T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2020-13817, CWE-330, CVSS 7.4, EPSS 0.00348

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.

CVSS Details

CVSS 3.1 Base Score: 7.4
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H)
CVSS 3.0 Base Score: 5.9
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Amazon Linux Ami 2	—	Upgrade ntp-debuginfoUpgrade ntp-docUpgrade ntp-perlUpgrade ntpdateUpgrade ntpUpgrade sntp	Jul 21, 2020	Jun 4, 2020
Centos_linux	—	Upgrade ntp-debuginfoUpgrade sntpUpgrade ntp-perlUpgrade ntp-docUpgrade ntpdateUpgrade ntp	Jun 24, 2020	Jun 4, 2020
Debian	—	Upgrade ntp	Jul 30, 2024	Jun 4, 2020
F5 Big Ip	—	Update F5 BIG-IP to the latest version	Jun 17, 2026	Sep 9, 2020
Gentoo Linux	—	Upgrade net-misc/ntp.	Jul 28, 2020	Jun 4, 2020
Huawei Euleros 2_0_sp2	—	Upgrade ntpUpgrade ntpdate	Nov 3, 2020	Jun 4, 2020
Huawei Euleros 2_0_sp5	—	Upgrade sntpUpgrade ntpdateUpgrade ntp	Sep 3, 2020	Jun 4, 2020
Huawei Euleros 2_0_sp8	—	Upgrade ntpUpgrade ntpdateUpgrade sntp	Jul 31, 2020	Jun 4, 2020
Ibm Aix	—	Apply the fix or workaround for ntp_advisory13	Oct 27, 2020	Jun 4, 2020
Ntp	—	Upgrade NTP to version 4.2.8Upgrade NTP to version 4.3.100	Feb 23, 2023	Jun 4, 2020
Oracle Solaris	—	Upgrade service/network/ntp to version 4.2.8.14-11.4.24.0.1.75.1 on Solaris 11.4	Jan 19, 2021	Jun 4, 2020
Oracle_linux	—	Upgrade ntpUpgrade sntpUpgrade ntp-perlUpgrade ntpdateUpgrade ntp-doc	Jun 24, 2020	Mar 3, 2020
Redhat_linux	—	Upgrade ntp-docNo solution existsUpgrade ntp-perlUpgrade ntpUpgrade ntpdateUpgrade sntpUpgrade ntp-debuginfo	Jun 24, 2020	Jun 4, 2020
Suse	—	Upgrade ntp-docUpgrade ntp	Jul 1, 2020	Jun 4, 2020

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence