Executive Summary
| Summary | |
|---|---|
| Title | HP-UX Running NTP, Remote Denial of Service (DoS) |
| Informations | |||
|---|---|---|---|
| Name | HPSBUX02960 SSRT101419 | First vendor Publication | 2014-01-13 |
| Vendor | HP | Last vendor Modification | 2014-05-23 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A potential security vulnerability has been identified with HP-UX running NTP. The vulnerability could be exploited remotely to create a Denial of Service (DoS). |
Original Source
| Url : http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c04084148 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:24449 | |||
| Oval ID: | oval:org.mitre.oval:def:24449 | ||
| Title: | Network Time Protocol (NTP) vulnerability in AIX | ||
| Description: | The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2013-5211 | Version: | 6 |
| Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26210 | |||
| Oval ID: | oval:org.mitre.oval:def:26210 | ||
| Title: | SUSE-SU-2014:0937-1 -- Security update for ntp | ||
| Description: | The NTP time service could have been used for remote denial of service amplification attacks. | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:0937-1 CVE-2013-5211 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | ntp |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
ExploitDB Exploits
| id | Description |
|---|---|
| 2014-04-28 | NTP ntpd monlist Query Reflection - Denial of Service |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2018-05-23 | SSDP M-SEARCH ssdp-all potential amplified distributed denial-of-service attempt RuleID : 45157-community - Revision : 4 - Type : SERVER-OTHER |
| 2018-01-11 | SSDP M-SEARCH ssdp-all potential amplified distributed denial-of-service attempt RuleID : 45157 - Revision : 4 - Type : SERVER-OTHER |
| 2015-05-19 | NTP mode 6 UNSETTRAP denial of service attempt RuleID : 34114 - Revision : 4 - Type : SERVER-OTHER |
| 2015-05-19 | NTP mode 6 REQ_NONCE denial of service attempt RuleID : 34112 - Revision : 4 - Type : SERVER-OTHER |
| 2014-02-15 | ntp monlist denial of service attempt RuleID : 29393 - Revision : 6 - Type : SERVER-OTHER |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2017-10-27 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2017-0165.nasl - Type : ACT_GATHER_INFO |
| 2017-02-08 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2017-0038.nasl - Type : ACT_GATHER_INFO |
| 2016-09-13 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-3613.nasl - Type : ACT_GATHER_INFO |
| 2016-09-13 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-3612.nasl - Type : ACT_GATHER_INFO |
| 2015-12-30 | Name : The remote VMware ESX / ESXi host is missing a security-related patch. File : vmware_VMSA-2014-0002_remote.nasl - Type : ACT_GATHER_INFO |
| 2015-05-22 | Name : The remote VMware ESXi 5.5 host is affected by multiple vulnerabilities. File : vmware_esxi_5_5_build_1623387_remote.nasl - Type : ACT_GATHER_INFO |
| 2015-01-29 | Name : The remote VMware ESXi 5.1 host is affected by multiple vulnerabilities. File : vmware_esxi_5_1_build_1743201_remote.nasl - Type : ACT_GATHER_INFO |
| 2015-01-29 | Name : The remote VMware ESXi 5.0 host is affected by multiple vulnerabilities. File : vmware_esxi_5_0_build_1749766_remote.nasl - Type : ACT_GATHER_INFO |
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_ntp_20140417.nasl - Type : ACT_GATHER_INFO |
| 2014-09-19 | Name : The remote device is missing a vendor-supplied security patch. File : juniper_jsa10613.nasl - Type : ACT_GATHER_INFO |
| 2014-08-01 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-474.nasl - Type : ACT_GATHER_INFO |
| 2014-07-31 | Name : The remote openSUSE host is missing a security update. File : suse_12_3_openSUSE-2014--140722.nasl - Type : ACT_GATHER_INFO |
| 2014-07-31 | Name : The remote openSUSE host is missing a security update. File : suse_13_1_openSUSE-2014--140722.nasl - Type : ACT_GATHER_INFO |
| 2014-07-30 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_ntp-140721.nasl - Type : ACT_GATHER_INFO |
| 2014-06-17 | Name : The remote AIX host is missing a security patch. File : aix_IV59636.nasl - Type : ACT_GATHER_INFO |
| 2014-06-17 | Name : The remote AIX host is missing a security patch. File : aix_IV58413.nasl - Type : ACT_GATHER_INFO |
| 2014-06-17 | Name : The remote AIX host is missing a security patch. File : aix_IV58068.nasl - Type : ACT_GATHER_INFO |
| 2014-06-17 | Name : The remote AIX host is missing a security patch. File : aix_IV56575.nasl - Type : ACT_GATHER_INFO |
| 2014-06-17 | Name : The remote AIX host is missing a security patch. File : aix_IV56324.nasl - Type : ACT_GATHER_INFO |
| 2014-06-17 | Name : The remote AIX host is missing a security patch. File : aix_IV56213.nasl - Type : ACT_GATHER_INFO |
| 2014-06-17 | Name : The remote AIX host is missing a security patch. File : aix_IV55365.nasl - Type : ACT_GATHER_INFO |
| 2014-03-12 | Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2014-0002.nasl - Type : ACT_GATHER_INFO |
| 2014-02-14 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-044-02.nasl - Type : ACT_GATHER_INFO |
| 2014-01-20 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201401-08.nasl - Type : ACT_GATHER_INFO |
| 2014-01-15 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_3d95c9a77d5c11e3a8c1206a8a720317.nasl - Type : ACT_GATHER_INFO |
| 2014-01-02 | Name : The remote NTP server is affected by a denial of service vulnerability. File : ntp_monlist_enabled.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-05-26 13:22:00 |
|
| 2014-01-14 17:18:17 |
|
