Vulnerability CVE-2020-15025
Published: 2020-06-24

Description:
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.

Type:

CWE-401

 (Improper Release of Memory Before Removing Last Reference ('Memory Leak'))

CVSS2 => (AV:N/AC:L/Au:S/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
2.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial
Affected software
NTP -> NTP 

 References:
https://bugs.gentoo.org/729458
https://security.netapp.com/advisory/ntap-20200702-0002/
https://support.ntp.org/bin/view/Main/NtpBug3661
https://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_Relea
Copyright 2024, cxsecurity.com

 

Back to Top