What’s Vulnerable › Vulnerabilities

CVE-2020-13817

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-04 · updated 2026-06-17
• Weakness: CWE-330

Description

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.

Affected products

• Fujitsu M10-1 Firmware: before xcp2410 — fixed in xcp2410
• Fujitsu M10-4 Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
• Fujitsu M10-4S Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
• Fujitsu M12-1 Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
• Fujitsu M12-2 Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
• Fujitsu M12-2S Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
• NetApp Cloud Backup: all versions
• Clustered Data ONTAP: all versions
• NetApp Data ONTAP operating in 7-Mode: all versions
• NetApp Element Software: all versions
• NetApp H300E Firmware: all versions
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500E Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700E Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp Hci Compute Node Firmware: all versions
• NetApp Hci Management Node: all versions
• NetApp Ontap Tools: all versions
• NetApp Solidfire: all versions
• NetApp Steelstore Cloud Integrated Storage: all versions
• NTP: before 4.2.8; from 4.3.0 before 4.3.100; 4.2.8, 4.2.8-p1, 4.2.8-p1-beta1, 4.2.8-p1-beta2, 4.2.8-p1-beta3, 4.2.8-p1-beta4 (+21) — fixed in 4.2.8, 4.3.100
• openSUSE Leap: 15.1, 15.2

How to fix

Upgrade to a fixed version: Fujitsu M10-1 Firmware xcp2410; Fujitsu M10-4 Firmware xcp2410, xcp3110; Fujitsu M10-4S Firmware xcp2410, xcp3110; Fujitsu M12-1 Firmware xcp2410, xcp3110; Fujitsu M12-2 Firmware xcp2410, xcp3110; Fujitsu M12-2S Firmware xcp2410, xcp3110; NTP 4.2.8, 4.3.100. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html
• http://support.ntp.org/bin/view/Main/NtpBug3596
• https://bugs.ntp.org/show_bug.cgi?id=3596
• https://security.gentoo.org/glsa/202007-12
• https://security.netapp.com/advisory/ntap-20200625-0004/
• https://www.oracle.com/security-alerts/cpujan2022.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html
• http://support.ntp.org/bin/view/Main/NtpBug3596
• https://bugs.ntp.org/show_bug.cgi?id=3596
• https://security.gentoo.org/glsa/202007-12

Get alerted when CVE-2020-13817 or the next vulnerability affects your stack