リモートホストにインストールされている F5 Networks BIG-IP のバージョンは、テスト済みバージョンより前です。したがって、K09940637 のアドバイザリに記載されている脆弱性の影響を受けます。

  - RFC 5905 で指定されているように、Network Time Protocol (NTP) は、固定のポート番号が必要ないモードでもポート 123 を使用します。これにより、リモートの攻撃者がオフパス攻撃を仕掛けやすくなります。
    (CVE-2019-11331)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端主機上安裝的 F5 Networks BIG-IP 版本為測試版本之前的版本。因此，它受到 K09940637 公告中提及的一個弱點影響。

  - RFC 5905 中所指定的網路時間通訊協定 (NTP) 會使用連接埠 123，即使對於不需要固定連接埠號碼的模式也是如此，這會讓遠端攻擊者更容易發動路徑外攻擊。
    (CVE-2019-11331)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程主机上安装的 F5 Networks BIG-IP 版本低于测试版本。因此，该应用程序受到 K09940637 公告中提及的漏洞的影响。

  - RFC 5905 中指定的网络时间协议 (NTP) 即使在不需要固定端口号的模式下也使用端口 123，这使得远程攻击者更容易进行路径外攻击。
    (CVE-2019-11331)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K09940637 advisory.

  - Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port     number is not required, which makes it easier for remote attackers to conduct off-path attacks.
    (CVE-2019-11331)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: denial of service by trigerring rate limiting on NTP server (CVE-2015-7705)

  - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a     GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
    (CVE-2014-5209)

  - ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with     knowledge of the configuration password and access to a computer entrusted to perform remote configuration     to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.
    (CVE-2015-5146)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution     (CVE-2018-12327)

  - The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a     denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1     requests, as exploited in the wild in December 2013. (CVE-2013-5211)

  - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a     GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
    (CVE-2014-5209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: denial of service by trigerring rate limiting on NTP server (CVE-2015-7705)

  - The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a     denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1     requests, as exploited in the wild in December 2013. (CVE-2013-5211)

  - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a     GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
    (CVE-2014-5209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	名稱	產品	系列	已發布	已更新	嚴重性
184226	F5 Networks BIG-IP : NTP の脆弱性 (K09940637)	Nessus	F5 Networks Local Security Checks	2023/11/2	2024/5/7	high
184226	F5 Networks BIG-IP：NTP 弱點 (K09940637)	Nessus	F5 Networks Local Security Checks	2023/11/2	2024/5/7	high
184226	F5 Networks BIG-IP：NTP 漏洞 (K09940637)	Nessus	F5 Networks Local Security Checks	2023/11/2	2024/5/7	high
184226	F5 Networks BIG-IP : NTP vulnerability (K09940637)	Nessus	F5 Networks Local Security Checks	2023/11/2	2024/5/7	high
198521	RHEL 7 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical
198530	RHEL 5 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical
198541	RHEL 6 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical

偵測

搜尋 Plugin

high

high

high

high

critical

critical

critical