Network Time Protocol

Tenable plugin 97861 flags NTP servers that respond to mode 6 control queries (readvar, peers, sysinfo, etc.) from arbitrary source addresses. The problem isn't that mode 6 leaks catastrophic data — it leaks daemon version, peer list, and system variables — it's that mode 6 replies can be dozens to hundreds of times larger than the query, giving a spoofed-source attacker a UDP amplification vector for reflection DDoS. Related CVEs include CVE-2016-9310 (mode 6 unauthenticated trap / DDoS vector, fixed in ntpd 4.2.8p9) and CVE-2013-5211 (monlist). The plugin fires on any NTP daemon — reference ntpd, chrony with cmdallow, Cisco IOS NTP, Juniper, Windows W32Time is not typically affected because it doesn't speak mode 6.

Tenable's MEDIUM rating is defensible as a compliance flag but overstates the risk to *your* organization. The victim of amplification is a third party on the internet, not you — the confidentiality leak is trivial (version banners you'd expose to Shodan anyway), and there is no code execution, no privilege gain, no lateral movement path. The only way this rating deserves to stay MEDIUM is if the affected host is internet-facing UDP/123 and your org cares about being a reflection source (ISP, cloud, regulated). For internal-only NTP infrastructure, this is a LOW finding — hygiene, not a fire.

Why this verdict

• No compromise of the scanned host. Mode 6 responses leak ntpd version and peer variables — nothing an attacker can pivot into RCE, credential theft, or lateral movement.
• Victim is external. The amplification harm accrues to whoever the attacker spoofs, not to you. This is a good-internet-citizen issue, not a fleet-defense issue.
• Friction: spoofing is required. BCP38 uRPF on Tier-1 carrier edges and hyperscaler egress filters block source-address spoofing from most of the internet — the attacker population is bounded.
• Role multiplier: none. NTP daemons run in a stateless time-service role. There is no high-value deployment scenario (DC, hypervisor, PAM, CI) where mode 6 responses turn into fleet compromise. The role-multiplier floor does not apply.
• Modern defaults already fix it. chrony (RHEL 8+, Ubuntu 20.04+) doesn't speak mode 6; ntpd packages since ~2017 ship restrict default noquery. New-build fleets are largely clean.
• Reputational / compliance tail exists. ISPs, hosting providers, and CDN/edge operators receive Shadowserver abuse notifications and can end up on RBLs — for those orgs, the finding stays MEDIUM.

Why not higher?

MEDIUM would require impact on the scanned host or its data. Mode 6 exposes only version and peer metadata, no auth material, no config secrets, no RCE. There is no chain that pivots from mode 6 response to endpoint compromise, so keeping this at MEDIUM misallocates SOC attention against genuinely exploitable findings.

Why not lower?

IGNORE would require zero externality. If the flagged host is internet-facing on UDP/123, it can be conscripted into reflection DDoS campaigns and generate abuse tickets, RBL entries, and potentially breach hosting-provider AUPs. LOW captures 'fix on a normal hygiene cadence' — the correct signal.

1. Block inbound UDP/123 at the perimeter for hosts that don't need to serve external NTP — Firewall/edge ACL: only your public stratum-1/2 servers (if any) should accept internet UDP/123. Everything else — internal servers, workstations, appliances — should egress-only to your NTP pool. Deploy within the noisgate mitigation SLA of 30 days if any flagged hosts are internet-facing; otherwise treat as backlog.
2. Set restrict default nomodify notrap nopeer noquery in ntp.conf — Pushes the daemon to refuse mode 6 (and mode 7) from anyone not explicitly permitted. Then allow local admin queries with restrict 127.0.0.1 / restrict ::1. Roll via config-management (Ansible/Puppet/Chef) across the fleet.
3. Migrate ntpd to chrony where feasible — chrony does not respond to mode 6 by default and has a smaller attack surface. RHEL 8+, Ubuntu 20.04+, and Amazon Linux 2023 use chrony as the default time daemon.
4. For Cisco IOS: no ntp allow mode control (or ntp allow mode control 3 with ACL) — Cisco devices are a common source of 97861 hits. The command disables mode 6 replies entirely. Apply via network-team change window.
5. Enable BCP38 / uRPF on your own edges — Doesn't fix the finding, but ensures your network cannot be used as a *spoofing origin* for anyone else's reflection attacks. Good-neighbor control.

Run on the target NTP host as any user, or against a remote target from your auditor workstation (network-reachable to UDP/123). Requires ntpq (package ntp or ntpsec-ntpq). Example: ./check_ntp_mode6.sh 10.0.0.5 — omit the argument to check localhost.

#!/usr/bin/env bash
# noisgate: Tenable 97861 — NTP Mode 6 responder check
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u
TARGET="${1:-127.0.0.1}"
TIMEOUT=3

if ! command -v ntpq >/dev/null 2>&1; then
  echo "UNKNOWN: ntpq not installed — install 'ntp' or 'ntpsec-ntpq' package"
  exit 2
fi

# Mode 6 readvar query — a responsive daemon returns system variables
RESP=$(timeout "$TIMEOUT" ntpq -c 'rv 0' "$TARGET" 2>&1)
RC=$?

if [ $RC -ne 0 ] && echo "$RESP" | grep -qiE 'timed? out|no server|refused|connection'; then
  echo "PATCHED: $TARGET does not respond to mode 6 readvar (or UDP/123 filtered)"
  exit 0
fi

if echo "$RESP" | grep -qiE 'version=|processor=|system=|stratum='; then
  echo "VULNERABLE: $TARGET responded to unauthenticated mode 6 readvar"
  echo "---"
  echo "$RESP" | head -5
  exit 1
fi

echo "UNKNOWN: inconclusive response from $TARGET"
echo "$RESP" | head -3
exit 2

Sources

1. Tenable plugin 97861
2. NVD CVE-2016-9310
3. ntp.org Bug 3118 advisory
4. Shadowserver NTP Version Report
5. Virtue Security — NTP Mode 6 Vulnerabilities
6. Red Hat CVE-2016-9310
7. APNIC — UDP-based amplification DDoS vector
8. F5 K87922456 CVE-2016-9310