Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 2 Jan 2014 18:36:07 +0100
From: Moritz Muehlenhoff <>
Subject: Re: Re: CVE to the ntp monlist DDoS issue?

On Mon, Dec 30, 2013 at 11:40:37PM +0100, Florian Weimer wrote:
> * Moritz Muehlenhoff:
> > On Mon, Dec 30, 2013 at 09:05:56AM -0500, wrote:
> >> Hash: SHA1
> >> 
> >> > Has anyone thought about assigning a CVE to this?
> >> 
> >> was assigned CVE-2013-5211.
> >
> > Shouldn't this rather be CVE-2010-XXXX ?
> I don't think this was previously discussed as a security issue in
> public.  There is a 2011 reference here that explicitly cites
> amplification factors, though:
> <>
> This has an odd feeling of déjà vu to me, but I suspect the previous
> discusssions have been on private channels of which I no longer have
> records.

This blog posting from 2010 already describes the attack:

| HD Moore also discussed that he had figured out a way to DDoS a
| system using NTP with very minimal requests.  Although he has not
| released data on this type of DDoS, we put our heads together here
| on what the attack could be.  When you make a monlist request, you
| send 1 udp packet to the NTP server and 600+ responses are returned.
| We think that using this request against all the NTP servers and
| peers, you could send hundreds of thousands of UDP packets to a
| victim with minimal request packets.  By spoofing the source address
| and requesting monlists repetitively, all responses from those NTP
| servers will be forwarded to the victim.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.