Vulnerability · Published Apr 17, 2020 · Assigned by mitre
CVE-2020-11868
High 7.5
In plain English
A high-severity security flaw in the ntp package (Ubuntu). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.1%top 18.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | ntp | no fix listed | UBUNTU-CVE-2020-11868 |
Affected products (as reported)
Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- [debian-lts-announce] 20200505 [SECURITY] [DLA 2201-1] ntp security update mailing-list, x_refsource_MLIST
- openSUSE-SU-2020:0934 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1007 vendor-advisory, x_refsource_SUSE
- GLSA-202007-12 vendor-advisory, x_refsource_GENTOO
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
- http://support.ntp.org/bin/view/Main/NtpBug3592 x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=1716665 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20200424-0002/ x_refsource_CONFIRM