CVE-2020-15025 Denial of service in n/a
Remote attackers can cause denial of service via memory consumption in NTP when CMAC keys are configured, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15025?
CVE-2020-15025 is a medium-severity denial of service vulnerability in Netapp Cloud Backup, published on 24 Jun 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.
Weakness: CWE-401
Which versions are affected by CVE-2020-15025?
It affects 16 products.
Products include Netapp 8300 Firmware, Netapp 8700 Firmware, Netapp A400 Firmware, Netapp Cloud Backup, Netapp H300e Firmware, Netapp H300s Firmware and 10 more.
How do I fix CVE-2020-15025?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-15025 being exploited?
There is no known exploitation of CVE-2020-15025 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-15025, GHSA-p62f-hvr2-5w5f, MGASA-2020-0281, OESA-2022-1952, OESA-2022-1953, USN-5175-1.