Login Request a demo
Medium severity · published Jun 24, 2020
CVE-2020-15025
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not…
4.9
CVSS
3.1%
EPSS
No
On KEV
Description
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
8F
8300 Firmware · Netapp
All versions, or not specified · source: NVD
8F
8700 Firmware · Netapp
All versions, or not specified · source: NVD
AF
A400 Firmware · Netapp
All versions, or not specified · source: NVD
CB
Cloud Backup · Netapp
All versions, or not specified · source: NVD
HF
H300e Firmware · Netapp
All versions, or not specified · source: NVD
HF
H300s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H410c Firmware · Netapp
All versions, or not specified · source: NVD
HF
H410s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H500e Firmware · Netapp
All versions, or not specified · source: NVD
HF
H500s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H700e Firmware · Netapp
All versions, or not specified · source: NVD
HF
H700s Firmware · Netapp
All versions, or not specified · source: NVD
Affected product
8F
8300 Firmware
Netapp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15025
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15025
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html
Issue Tracking
https://bugs.gentoo.org/729458
Third Party Advisory
https://security.gentoo.org/glsa/202007-12
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200702-0002/
Vendor Advisory
https://support.ntp.org/bin/view/Main/NtpBug3661
More from 8300 Firmware
7.0
CVE-2021-22600
Double Free in net/packet/af_packet.c leading to priviledge escalation
8.1
CVE-2024-6387
Openssh: regresshion - race condition in ssh allows rce/dos
7.8
CVE-2022-30594
The Linux kernel before 5.17.2 mishandles seccomp permissions
7.8
CVE-2020-29661
A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13
7.8
CVE-2020-8835
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads…