{"document":{"aggregate_severity":{"namespace":"https://access.redhat.com/security/updates/classification/","text":"Moderate"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/vex/2013/cve-2013-5211.json"}],"title":"ntp: DoS in monlist feature in ntpd","tracking":{"current_release_date":"2025-11-21T12:36:47+00:00","generator":{"date":"2025-11-21T12:36:47+00:00","engine":{"name":"Red Hat SDEngine","version":"4.6.12"}},"id":"CVE-2013-5211","initial_release_date":"2013-01-01T00:00:00+00:00","revision_history":[{"date":"2013-01-01T00:00:00+00:00","number":"1","summary":"Initial version"},{"date":"2025-04-11T01:11:39+00:00","number":"2","summary":"Current version"},{"date":"2025-11-21T12:36:47+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 5","product":{"name":"Red Hat Enterprise Linux 5","product_id":"red_hat_enterprise_linux_5","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:5"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 5"},{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 6","product":{"name":"Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:6"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 6"},{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 7","product":{"name":"Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:7"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 7"},{"category":"product_version","name":"ntp","product":{"name":"ntp","product_id":"ntp","product_identification_helper":{"purl":"pkg:rpm/redhat/ntp?arch=src"}}},{"category":"product_version","name":"ntp-doc","product":{"name":"ntp-doc","product_id":"ntp-doc","product_identification_helper":{"purl":"pkg:rpm/redhat/ntp-doc"}}},{"category":"product_version","name":"ntp-perl","product":{"name":"ntp-perl","product_id":"ntp-perl","product_identification_helper":{"purl":"pkg:rpm/redhat/ntp-perl"}}},{"category":"product_version","name":"ntpdate","product":{"name":"ntpdate","product_id":"ntpdate","product_identification_helper":{"purl":"pkg:rpm/redhat/ntpdate"}}},{"category":"product_version","name":"ntp.src","product":{"name":"ntp.src","product_id":"ntp.src","product_identification_helper":{"purl":"pkg:rpm/redhat/ntp?arch=src"}}},{"category":"product_version","name":"sntp","product":{"name":"sntp","product_id":"sntp","product_identification_helper":{"purl":"pkg:rpm/redhat/sntp"}}}],"category":"vendor","name":"Red Hat"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"ntp as a component of Red Hat Enterprise Linux 5","product_id":"red_hat_enterprise_linux_5:ntp"},"product_reference":"ntp","relates_to_product_reference":"red_hat_enterprise_linux_5"},{"category":"default_component_of","full_product_name":{"name":"ntp as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:ntp"},"product_reference":"ntp","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"ntp-doc as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:ntp-doc"},"product_reference":"ntp-doc","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"ntp-perl as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:ntp-perl"},"product_reference":"ntp-perl","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"ntp.src as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:ntp.src"},"product_reference":"ntp.src","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"ntpdate as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:ntpdate"},"product_reference":"ntpdate","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"ntp as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:ntp"},"product_reference":"ntp","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"ntp-doc as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:ntp-doc"},"product_reference":"ntp-doc","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"ntp-perl as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:ntp-perl"},"product_reference":"ntp-perl","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"ntp.src as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:ntp.src"},"product_reference":"ntp.src","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"ntpdate as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:ntpdate"},"product_reference":"ntpdate","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"sntp as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:sntp"},"product_reference":"sntp","relates_to_product_reference":"red_hat_enterprise_linux_7"}]},"vulnerabilities":[{"cve":"CVE-2013-5211","discovery_date":"2014-01-02T00:00:00+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["red_hat_enterprise_linux_7:ntp","red_hat_enterprise_linux_7:ntp-doc","red_hat_enterprise_linux_7:ntp-perl","red_hat_enterprise_linux_7:ntp.src","red_hat_enterprise_linux_7:ntpdate","red_hat_enterprise_linux_7:sntp"]}],"ids":[{"system_name":"Red Hat Bugzilla ID","text":"1047854"}],"notes":[{"category":"description","text":"The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.","title":"Vulnerability description"},{"category":"summary","text":"ntp: DoS in monlist feature in ntpd","title":"Vulnerability summary"},{"category":"other","text":"This issue does not affect the default configuration of ntp packages shipped with Red Hat Enterprise Linux, which does not allow remote ntpd control queries. User changing ntpd access control configuration should consider reviewing additional information provided via https://bugzilla.redhat.com/show_bug.cgi?id=1047854#c27 to avoid exposing their systems to this traffic amplification issue.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"known_affected":["red_hat_enterprise_linux_5:ntp","red_hat_enterprise_linux_6:ntp","red_hat_enterprise_linux_6:ntp-doc","red_hat_enterprise_linux_6:ntp-perl","red_hat_enterprise_linux_6:ntp.src","red_hat_enterprise_linux_6:ntpdate"],"known_not_affected":["red_hat_enterprise_linux_7:ntp","red_hat_enterprise_linux_7:ntp-doc","red_hat_enterprise_linux_7:ntp-perl","red_hat_enterprise_linux_7:ntp.src","red_hat_enterprise_linux_7:ntpdate","red_hat_enterprise_linux_7:sntp"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2013-5211"},{"category":"external","summary":"RHBZ#1047854","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1047854"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2013-5211","url":"https://www.cve.org/CVERecord?id=CVE-2013-5211"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2013-5211","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5211"},{"category":"external","summary":"https://www.us-cert.gov/ncas/alerts/TA14-013A","url":"https://www.us-cert.gov/ncas/alerts/TA14-013A"}],"release_date":"2010-04-20T00:00:00+00:00","remediations":[{"category":"no_fix_planned","details":"Will not fix","product_ids":["red_hat_enterprise_linux_5:ntp","red_hat_enterprise_linux_6:ntp","red_hat_enterprise_linux_6:ntp-doc","red_hat_enterprise_linux_6:ntp-perl","red_hat_enterprise_linux_6:ntp.src","red_hat_enterprise_linux_6:ntpdate"]}],"scores":[{"cvss_v2":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":4.3,"confidentialityImpact":"NONE","integrityImpact":"NONE","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","version":"2.0"},"products":["red_hat_enterprise_linux_5:ntp","red_hat_enterprise_linux_6:ntp","red_hat_enterprise_linux_6:ntp-doc","red_hat_enterprise_linux_6:ntp-perl","red_hat_enterprise_linux_6:ntp.src","red_hat_enterprise_linux_6:ntpdate","red_hat_enterprise_linux_7:ntp","red_hat_enterprise_linux_7:ntp-doc","red_hat_enterprise_linux_7:ntp-perl","red_hat_enterprise_linux_7:ntp.src","red_hat_enterprise_linux_7:ntpdate","red_hat_enterprise_linux_7:sntp"]}],"threats":[{"category":"impact","details":"Moderate","product_ids":["red_hat_enterprise_linux_5:ntp","red_hat_enterprise_linux_6:ntp","red_hat_enterprise_linux_6:ntp-doc","red_hat_enterprise_linux_6:ntp-perl","red_hat_enterprise_linux_6:ntp.src","red_hat_enterprise_linux_6:ntpdate","red_hat_enterprise_linux_7:ntp","red_hat_enterprise_linux_7:ntp-doc","red_hat_enterprise_linux_7:ntp-perl","red_hat_enterprise_linux_7:ntp.src","red_hat_enterprise_linux_7:ntpdate","red_hat_enterprise_linux_7:sntp"]}],"title":"ntp: DoS in monlist feature in ntpd"}]}