Back to Database
Status published
Medium
CVE-2020-15025
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101...
Vulnerability Description
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15025
Credits & Attribution
No credits recorded in the NVD database.
References
- https://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_Relea
- https://support.ntp.org/bin/view/Main/NtpBug3661
- https://bugs.gentoo.org/729458
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html
- https://security.gentoo.org/glsa/202007-12
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://security.netapp.com/advisory/ntap-20200702-0002/
More from ntp
View All →CVE-2020-13817
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows...
Medium
5.9
CVE-2020-11868
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows...
Medium
5.9
CVE-2019-11331
Network Time Protocol (NTP), as specified in RFC 5905, uses...
High
8.1
CVE-2018-8956
ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote...
Medium
5.3
CVE-2018-7185
The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a...
High
7.5
Affected Vendor
Affected Software
ntp, leap, cloud backup, steelstore cloud integrated storage, 8300 firmware, 8700 firmware, a400 firmware, h410c firmware, h300s firmware, h500s firmware, h700s firmware, h300e firmware, h500e firmware, h700e firmware, h410s firmware, zfs storage appliance kit
Vulnerable Versions:
4.3.97, 4.2.8, 15.1, 15.2, 8.8
Timeline
Official Publish:
June 24th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AC:H/AV:N/A:H/C:N/I:N/PR:H/S:U/UI:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.