How to Buy
This script is Copyright (C) 2014-2016 Tenable Network Security, Inc.
The remote NTP server is affected by a denial of service
The version of ntpd running on the remote host has the 'monlist'
command enabled. This command returns a list of recent hosts that have
connected to the service. However, it is affected by a denial of
service vulnerability in ntp_request.c that allows an unauthenticated,
remote attacker to saturate network traffic to a specific IP address
by using forged REQ_MON_GETLIST or REQ_MON_GETLIST_1 requests.
Furthermore, an attacker can exploit this issue to conduct
reconnaissance or distributed denial of service (DDoS) attacks.
See also :
If using NTP from the Network Time Protocol Project, upgrade to
NTP version 4.2.7-p26 or later. Alternatively, add 'disable monitor'
to the ntp.conf configuration file and restart the service. Otherwise,
limit access to the affected service to trusted hosts, or contact the
vendor for a fix.
Risk factor :
Medium / CVSS Base Score : 5.0
CVSS Temporal Score : 4.1
Public Exploit Available : true
Nessus Plugin ID: 71783 ()
Bugtraq ID: 64692
CVE ID: CVE-2013-5211
Nessus Professional: Scan unlimited IPs, run compliance checks & moreNessus Cloud: The power of Nessus for teams – from the cloud
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.