Skip to content
OpenAdvisories
Medium ALAS2-2021-1706 1 CVE

Moderate: ntp security update (Amazon Linux 2)

Published Sep 8, 2021 · Updated Sep 15, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2013-5211: The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013. 1047854: CVE-2013-5211 ntp: DoS in monlist feature in ntpd

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 ntp 0:4.2.8p15-3.amzn2.0.4
Amazon Linux · 2 ntp-debuginfo 0:4.2.8p15-3.amzn2.0.4
Amazon Linux · 2 ntp-doc 0:4.2.8p15-3.amzn2.0.4
Amazon Linux · 2 ntp-perl 0:4.2.8p15-3.amzn2.0.4
Amazon Linux · 2 ntpdate 0:4.2.8p15-3.amzn2.0.4
Amazon Linux · 2 sntp 0:4.2.8p15-3.amzn2.0.4

Vulnerabilities 1

  • Unscored —
    CVE-2013-5211 Public exploit EPSS 98%

    The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of servic…

    ntp Debian

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2013-5211.html