The vulnerability of the NTP synchronization protocol lies in the use of insufficiently random values, which allows a perpetrator to cause a service failure.

🗓️ 23 Sep 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 7 Views

NTP protocol vulnerable due to insufficiently random values enabling remote attacker to cause outage.

Reporter	Title	Published	Views	Family All 104
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to a security vulnerability (CVE-2020-11868, CVE-2020-13817)	8 Jul 202117:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by Network Time Protocol (NTP) vulnerabilities (CVE-2020-11868, CVE-2020-13817)	27 Nov 202002:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in Network Time Protocol (NTP)	7 Dec 202322:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities	12 Jan 202110:48	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been fixed in the IBM Security Access Manager and IBM Security Verify Access products	14 Oct 202016:31	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in ntp (CVE-2020-11868 and CVE-2020-13817).	22 Sep 202123:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in NTPv4 affect AIX (CVE-2020-11868, CVE-2020-13817, and CVE-2020-15025)	26 Oct 202022:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture is vulnerable to Using Components with Known Vulnerabilities	30 Oct 202016:18	–	ibm
Tenable Nessus	Amazon Linux 2 : ntp (ALAS-2020-1455)	20 Jul 202000:00	–	nessus
Tenable Nessus	CentOS 7 : ntp (RHSA-2020:2663)	24 Jun 202000:00	–	nessus

Vulners

Node

OR

network_time ntpRange<4.2.8

network_time ntpRange4.3.0–4.3.100

Source	Link
lists	www.lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html
lists	www.lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html
support	www.support.ntp.org/bin/view/Main/NtpBug3596
bugs	www.bugs.ntp.org/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-13817
security	www.security.gentoo.org/glsa/202007-12
security	www.security.netapp.com/advisory/ntap-20200625-0004/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-13817
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17
oracle	www.oracle.com/security-alerts/cpujan2022.html

18 Feb 2025 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 25.8

CVSS 35.9

EPSS0.04071

network time protocol insufficient randomness remote attacker service outage