CVE-2013-5211
Summary
| CVE | CVE-2013-5211 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2014-01-02 14:59:00 UTC |
|---|
| Updated | 2023-11-01 12:51:00 UTC |
|---|
| Description | The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Application |
Ntp |
Ntp |
All |
All |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
All |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
- |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p0 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p1 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p10 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p11 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p12 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p13 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p14 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p15 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p16 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p17 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p18 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p19 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p2 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p20 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p21 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p22 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p23 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p24 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p25 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p3 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p4 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p5 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p6 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p7 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p8 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
p9 |
All |
All |
| Application |
Ntp |
Ntp |
4.2.7 |
All |
All |
All |
| Operating System |
Opensuse |
Opensuse |
11.4 |
All |
All |
All |
| Operating System |
Opensuse |
Opensuse |
11.4 |
All |
All |
All |
| Operating System |
Oracle |
Linux |
6 |
- |
All |
All |
| Operating System |
Oracle |
Linux |
7 |
- |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| Vulnerability Note VU#348126 - NTP can be abused to amplify denial-of-service attack traffic |
CERT-VN |
www.kb.cert.org |
Third Party Advisory, US Government Resource |
| openSUSE-SU-2014:1149-1: moderate: Avoid ntp being used as a DDoS amplif |
SUSE |
lists.opensuse.org |
|
| Oracle Linux Bulletin - July 2016 |
CONFIRM |
www.oracle.com |
|
| oss-security - CVE to the ntp monlist DDoS issue? |
MLIST |
openwall.com |
|
| Security Advisory SA59726 - IBM Flex System Manager Node (FSM) NTP Mode 7 Denial of Service Vulnerability - Secunia |
SECUNIA |
secunia.com |
|
| aix.software.ibm.com/aix/efixes/security/ntp_advisory.asc |
CONFIRM |
aix.software.ibm.com |
|
| HPE Support document - HPE Support Center |
CONFIRM |
h20564.www2.hpe.com |
|
| [Pool] Odd surge in traffic today |
MLIST |
lists.ntp.org |
|
| About Secunia Research | Flexera |
SECUNIA |
secunia.com |
|
| Advisory: puppetlabs-ntp default configuration does not fully mitigate CVE-2013-5211 | Puppet |
CONFIRM |
puppet.com |
|
| oss-security - Re: CVE to the ntp monlist DDoS issue? |
MLIST |
openwall.com |
|
| '[security bulletin] HPSBOV03505 rev.1 - TCP/IP Services for OpenVMS running NTP, Remote Code Executi' - MARC |
HP |
marc.info |
|
| NTP Reflection Attack | ICS-CERT |
MISC |
ics-cert.us-cert.gov |
Third Party Advisory, US Government Resource |
| NTP 'ntp_request.c' Remote Denial of Service Vulnerability |
BID |
www.securityfocus.com |
|
| IBM AIX ntpd Query Function Lets Remote Users Conduct Amplified Denial of Service Attacks - SecurityTracker |
SECTRACK |
www.securitytracker.com |
|
| IBM Support |
CONFIRM |
www-947.ibm.com |
|
| IBM Support |
CONFIRM |
www-947.ibm.com |
|
| NTP Amplification Attacks Using CVE-2013-5211 | US-CERT |
CERT |
www.us-cert.gov |
Third Party Advisory, US Government Resource |
| '[security bulletin] HPSBUX02960 SSRT101419 rev.1 - HP-UX Running NTP, Remote Denial of Service (DoS)' - MARC |
HP |
marc.info |
|
| Bug 1532 – remove ntpd support for ntpdc's monlist (use ntpq's mrulist) |
CONFIRM |
bugs.ntp.org |
|
| www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-dev/ntp-dev-4.2.7p26.tar.gz |
CONFIRM |
www.eecis.udel.edu |
Patch |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 352837 Amazon Linux Security Advisory for ntp: ALAS2-2021-1706
- 44030 Juniper Network Operating System (Junos OS) Multiple NTP Vulnerabilities (JSA11171)
