Network Time Protocol Daemon

The monlist (aka MON_GETLIST) command in ntpd returns the last 600 hosts that queried the service. Because the request is a small UDP packet and the response is dozens of full packets, an attacker who spoofs the source IP of a victim can point your NTP server at that victim and get a ~200x–500x bandwidth amplification. This affects ntp.org ntpd before 4.2.7p26 (which disabled monlist by default) — meaning every stock ntpd on RHEL/CentOS 5/6, older Debian/Ubuntu LTS, older Junos, older Cisco IOS with NTP enabled, embedded devices, and any appliance that hasn't been rebuilt since ~2014.

Tenable rates this MEDIUM based on CVSSv2=5.0 (Availability: Partial, no confidentiality or integrity impact to *your* host). That framing is wrong for enterprise defenders. The CVSSv3 rescore is 7.5 (HIGH) and CISA issued TA14-013A in January 2014 specifically because this bug fueled the largest DDoS attacks on record at the time (400+ Gbps against CloudFlare/Spamhaus). EPSS is ~0.92 (99th percentile) — it is actively, continuously scanned and abused. Vendor MEDIUM does not match reality.

Why this verdict

• Trivial exploitation, no auth, no chain: a single UDP packet is the entire attack. There is no friction stack to walk down.
• EPSS 0.921 / 99th percentile: this is one of the most-probed services on the internet. If you are exposed, you *are* being tested continuously.
• Role multiplier — NTP servers are typically member hosts, not fleet-critical: chain does NOT lead to domain compromise, data egress, or supply-chain pivot. Blast radius is *bandwidth abuse of your uplink* + *reputational damage of participating in someone else's DDoS*. That caps the verdict at HIGH — this is not CRITICAL floor territory (no identity, hypervisor, PKI, backup, or edge-appliance role).
• Friction audit: internet-facing exposure is the only prerequisite; internal ntpd hosts behind a firewall that blocks inbound UDP/123 are effectively unreachable and could be argued down to MEDIUM. But the plugin fires precisely because Tenable saw a response — so at scan time the host is reachable from the scanner's vantage.

Why not higher?

The bug never yields code execution, data disclosure, or credentials on your host. Your ntpd is a weapon, not a foothold. There is no lateral-movement or privilege-escalation vector, and NTP servers are not canonical identity/hypervisor/PAM/backup roles, so the CRITICAL floor does not apply.

Why not lower?

MEDIUM is what the vendor gave it and it's demonstrably wrong: CVSSv3 rescores at 7.5, EPSS is at the 99th percentile, CISA issued a nation-scale alert (TA14-013A), and the bug enables measurable financial and reputational third-party harm. Calling this MEDIUM tells patch teams it can wait — it can't.

1. Add disable monitor to /etc/ntp.conf and restart ntpd — Kills the monlist feature at runtime without upgrading the package. Push via config management (Ansible/Puppet/Salt) as your first move — deploy within 30 days per the noisgate mitigation SLA for HIGH, but realistically you can ship this fleet-wide in one change window.
2. Restrict default access: restrict default kod nomodify notrap nopeer noquery and restrict -6 default kod nomodify notrap nopeer noquery — Blocks all mode 6/7 control queries by default. Only NTP clients — not query tools — can talk to the daemon. Combine with explicit restrict lines for your peer sources. Deploy alongside the disable monitor change.
3. Firewall UDP/123 inbound at the perimeter and cloud SG — The only legitimate inbound NTP-facing hosts are stratum-1/2 public providers. Everyone else should serve NTP *only* to internal ranges. Push an ingress deny rule on edge firewalls and cloud security groups within the noisgate HIGH mitigation window (≤ 30 days).
4. Migrate to chrony where possible — chrony has never implemented monlist and defaults to cmdallow restricted to localhost. RHEL 7+ ships chrony by default. Long-term hygiene, not urgent.
5. Enable BCP38/uRPF egress filtering with your ISP — Prevents spoofed source packets from reaching your reflector in the first place, and prevents your network from being used to spoof others. Independently valuable.

Run from an auditor workstation (not the target host) so you're testing what the internet sees. Requires ntpdc (deprecated but present in most distros; install ntp package) or nmap. Invoke: ./check_ntp_monlist.sh 203.0.113.10. No privileges required.

#!/usr/bin/env bash
# noisgate: CVE-2013-5211 / Tenable 71783 monlist reflection check
# Usage: ./check_ntp_monlist.sh <target-ip-or-host>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <target-ip-or-host>" >&2
  exit 2
fi

# Method 1: ntpdc monlist (works even with modern OpenNTPD/legacy ntpd)
if command -v ntpdc >/dev/null 2>&1; then
  RESP=$(timeout 5 ntpdc -n -c monlist "$TARGET" 2>&1)
  if echo "$RESP" | grep -qiE 'remote address|client|mode'; then
    echo "VULNERABLE: $TARGET responded to monlist with peer data"
    echo "$RESP" | head -5
    exit 1
  fi
  if echo "$RESP" | grep -qiE 'timed out|no server|Connection refused|not found'; then
    :
  else
    # ntpdc responded but returned no rows - could be empty monlist (still vulnerable) or refused
    if echo "$RESP" | grep -qiE 'authentication|access denied|no data'; then
      echo "PATCHED: $TARGET refused monlist (access denied / disabled)"
      exit 0
    fi
  fi
fi

# Method 2: nmap NSE fallback
if command -v nmap >/dev/null 2>&1; then
  NRESP=$(timeout 15 nmap -sU -pU:123 -Pn --script=ntp-monlist "$TARGET" 2>&1)
  if echo "$NRESP" | grep -qi 'Public Servers\|Other Associations\|ntp-monlist:'; then
    if echo "$NRESP" | grep -A2 'ntp-monlist' | grep -qE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'; then
      echo "VULNERABLE: $TARGET nmap ntp-monlist returned peer entries"
      exit 1
    fi
  fi
  if echo "$NRESP" | grep -qi '123/udp open'; then
    echo "PATCHED (or hardened): UDP/123 open but monlist did not return peer data"
    exit 0
  fi
fi

echo "UNKNOWN: could not conclusively probe $TARGET (host unreachable, UDP/123 filtered, or tools missing)"
exit 2

Sources

1. Tenable Plugin 71783
2. CISA TA14-013A: NTP Amplification Attacks
3. NVD CVE-2013-5211
4. Tenable CVE-2013-5211
5. Red Hat CVE-2013-5211
6. Juniper Junos SB 2014-07
7. VulDB / NTP Bug 1532
8. US-CERT VU#348126