CVE-2019-11331

Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

On Red Hat Enterprise Linux 6 and later, switching from ntp to chrony is recommended. Among other design improvements, chrony uses a randomised source port by default.

If using ntp, the source port can be randomised by iptables masquerading rules, effectively mitigating this vulnerability:

iptables -t nat -I POSTROUTING -p udp -m udp --sport 123 -j MASQUERADE --to-ports 60000-61000