Vulnerabilities > NTP

DATE CVE VULNERABILITY TITLE RISK
2020-06-24 CVE-2020-15025 Memory Leak vulnerability in NTP
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.
network
low complexity
ntp CWE-401
4.0
2020-06-04 CVE-2020-13817 Improper Input Validation vulnerability in NTP
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets.
network
ntp CWE-20
5.8
2020-05-06 CVE-2018-8956 Improper Input Validation vulnerability in NTP 4.2.8
ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets.
network
low complexity
ntp CWE-20
5.0
2020-04-17 CVE-2020-11868 Resource Exhaustion vulnerability in multiple products
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.
network
low complexity
ntp redhat netapp debian CWE-400
5.0
2020-01-28 CVE-2015-7851 Path Traversal vulnerability in NTP
Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.
network
low complexity
ntp CWE-22
3.5
2020-01-08 CVE-2014-5209 Information Exposure vulnerability in multiple products
An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
network
low complexity
ntp f5 CWE-200
5.0
2019-05-15 CVE-2019-8936 Null Pointer Dereference vulnerability in multiple products
NTP through 4.2.8p12 has a NULL Pointer Dereference.
5.0
2019-04-18 CVE-2019-11331 Unspecified vulnerability in NTP
Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks.
network
ntp
6.8
2018-06-20 CVE-2018-12327 Out-Of-Bounds Write vulnerability in NTP 4.2.8
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter.
network
low complexity
ntp CWE-787
7.5
2018-06-04 CVE-2016-9042 Improper Input Validation vulnerability in multiple products
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9.
network
ntp freebsd CWE-20
4.3