The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K09940637 advisory.

  - Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port     number is not required, which makes it easier for remote attackers to conduct off-path attacks.
    (CVE-2019-11331)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: denial of service by trigerring rate limiting on NTP server (CVE-2015-7705)

  - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a     GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
    (CVE-2014-5209)

  - ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with     knowledge of the configuration password and access to a computer entrusted to perform remote configuration     to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.
    (CVE-2015-5146)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution     (CVE-2018-12327)

  - The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a     denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1     requests, as exploited in the wild in December 2013. (CVE-2013-5211)

  - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a     GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
    (CVE-2014-5209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: denial of service by trigerring rate limiting on NTP server (CVE-2015-7705)

  - The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a     denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1     requests, as exploited in the wild in December 2013. (CVE-2013-5211)

  - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a     GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
    (CVE-2014-5209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
184226	F5 Networks BIG-IP : NTP vulnerability (K09940637)	Nessus	F5 Networks Local Security Checks	11/2/2023	5/7/2024	high
198521	RHEL 7 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
198530	RHEL 5 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
198541	RHEL 6 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical

Detections

Analytics

Plugins Search

high

critical

critical

critical