Network Time Protocol (NTP) Mode 6 Scanner

Tenable plugin 97861 flags NTP servers that respond to mode 6 control queries (readvar, peers, sysinfo, etc.) from arbitrary source addresses. The problem isn't that mode 6 leaks catastrophic data — it leaks daemon version, peer list, and system variables — it's that mode 6 replies can be dozens to hundreds of times larger than the query, giving a spoofed-source attacker a UDP amplification vector for reflection DDoS. Related CVEs include CVE-2016-9310 (mode 6 unauthenticated trap / DDoS vector, fixed in ntpd 4.2.8p9) and CVE-2013-5211 (monlist). The plugin fires on any NTP daemon — reference ntpd, chrony with cmdallow, Cisco IOS NTP, Juniper, Windows W32Time is not typically affected because it doesn't speak mode 6.

Tenable's MEDIUM rating is defensible as a compliance flag but overstates the risk to *your* organization. The victim of amplification is a third party on the internet, not you — the confidentiality leak is trivial (version banners you'd expose to Shodan anyway), and there is no code execution, no privilege gain, no lateral movement path. The only way this rating deserves to stay MEDIUM is if the affected host is internet-facing UDP/123 and your org cares about being a reflection source (ISP, cloud, regulated). For internal-only NTP infrastructure, this is a LOW finding — hygiene, not a fire.

Sources.

1. Tenable plugin 97861
2. NVD CVE-2016-9310
3. ntp.org Bug 3118 advisory
4. Shadowserver NTP Version Report
5. Virtue Security — NTP Mode 6 Vulnerabilities
6. Red Hat CVE-2016-9310
7. APNIC — UDP-based amplification DDoS vector
8. F5 K87922456 CVE-2016-9310

Run on the target NTP host as any user, or against a remote target from your auditor workstation (network-reachable to UDP/123). Requires ntpq (package ntp or ntpsec-ntpq). Example: ./check_ntp_mode6.sh 10.0.0.5 — omit the argument to check localhost.

#!/usr/bin/env bash
# noisgate: Tenable 97861 — NTP Mode 6 responder check
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u
TARGET="${1:-127.0.0.1}"
TIMEOUT=3

if ! command -v ntpq >/dev/null 2>&1; then
  echo "UNKNOWN: ntpq not installed — install 'ntp' or 'ntpsec-ntpq' package"
  exit 2
fi

# Mode 6 readvar query — a responsive daemon returns system variables
RESP=$(timeout "$TIMEOUT" ntpq -c 'rv 0' "$TARGET" 2>&1)
RC=$?

if [ $RC -ne 0 ] && echo "$RESP" | grep -qiE 'timed? out|no server|refused|connection'; then
  echo "PATCHED: $TARGET does not respond to mode 6 readvar (or UDP/123 filtered)"
  exit 0
fi

if echo "$RESP" | grep -qiE 'version=|processor=|system=|stratum='; then
  echo "VULNERABLE: $TARGET responded to unauthenticated mode 6 readvar"
  echo "---"
  echo "$RESP" | head -5
  exit 1
fi

echo "UNKNOWN: inconclusive response from $TARGET"
echo "$RESP" | head -3
exit 2