The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.
La característica monlist en ntp_request.c en ntpd en NTP antes 4.2.7p26 permite a atacantes remotos provocar una denegación de servicio (amplificación de tráfico) a través de solicitudes (1) REQ_MON_GETLIST o (2) solicitudes REQ_MON_GETLIST_1, como han sido explotados en diciembre de 2013.
AV:N/AC:L/Au:N/C:N/I:N/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-20
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| opensuse | opensuse | 11.4 | <built-in method update of dict object at 0x72a9b092a040> | Operating System |
| ntp | ntp | * | <built-in method update of dict object at 0x72a9a23a1a80> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9a23a0980> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b092a900> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b092a480> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b092bf00> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9a23a36c0> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b092bc40> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9a23a3e00> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b092acc0> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b0929240> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b092a5c0> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9a23a3e80> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9cc479500> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9e4155580> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9a23a1ec0> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b0928e00> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9a23a3500> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9a23a12c0> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72ab5932f740> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b0b027c0> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9cddc26c0> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9a23a1680> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9ccf88780> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9a23a2d00> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9cc62c940> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b09294c0> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b092a840> | Application |
| ntp | ntp | 4.2.7 | <built-in method update of dict object at 0x72a9b0929e00> | Application |
| oracle | linux | 6 | <built-in method update of dict object at 0x72a9ccf89a40> | Operating System |
| oracle | linux | 7 | <built-in method update of dict object at 0x72a9ccf894c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p0:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p10:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p11:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p12:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p13:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p14:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p15:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p16:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p17:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p18:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p19:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p20:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p21:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p22:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p23:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p24:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p25:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p4:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p5:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p6:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p7:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p8:*:*:*:*:*:* |
| Yes | cpe:2.3:a:ntp:ntp:4.2.7:p9:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:* |