What’s Vulnerable › Vulnerabilities

CVE-2020-11868

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-17 · updated 2026-06-17
• Weakness: CWE-346

Description

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.

Affected products

• Debian Linux: 8.0
• NetApp All Flash Fabric-Attached Storage 8300 Firmware: all versions
• NetApp All Flash Fabric-Attached Storage 8700 Firmware: all versions
• NetApp All Flash Fabric-Attached Storage A400 Firmware: all versions
• Clustered Data ONTAP: all versions
• NetApp Data ONTAP operating in 7-Mode: all versions
• NetApp Fabric-Attached Storage 8300 Firmware: all versions
• NetApp Fabric-Attached Storage 8700 Firmware: all versions
• NetApp Fabric-Attached Storage A400 Firmware: all versions
• NetApp Hci Management Node: all versions
• NetApp Hci Storage Node Firmware: all versions
• NetApp Solidfire: all versions
• NetApp Vasa Provider For Clustered Data Ontap: from 7.2
• NetApp Virtual Storage Console: from 7.2
• NTP: through 4.2.7; from 4.3.98 before 4.3.100; 4.2.8, 4.2.8-p1, 4.2.8-p1-beta1, 4.2.8-p1-beta2, 4.2.8-p1-beta3, 4.2.8-p1-beta4 (+21) — fixed in 4.3.100
• openSUSE Leap: 15.1, 15.2
• Red Hat Enterprise Linux: 7.0

How to fix

Upgrade to a fixed version: NTP 4.3.100. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html
• http://support.ntp.org/bin/view/Main/NtpBug3592
• https://bugzilla.redhat.com/show_bug.cgi?id=1716665
• https://lists.debian.org/debian-lts-announce/2020/05/msg00004.html
• https://security.gentoo.org/glsa/202007-12
• https://security.netapp.com/advisory/ntap-20200424-0002/
• https://www.oracle.com//security-alerts/cpujul2021.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html
• http://support.ntp.org/bin/view/Main/NtpBug3592
• https://bugzilla.redhat.com/show_bug.cgi?id=1716665

Get alerted when CVE-2020-11868 or the next vulnerability affects your stack