Vulnerability Description
Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ntp | Ntp | >= 4.2.0, < 4.2.8 |
Related Weaknesses (CWE)
References
- http://support.ntp.org/bin/view/Main/NtpBug2918Vendor Advisory
- http://support.ntp.org/bin/view/Main/SecurityNoticeRelease NotesVendor Advisory
- http://www.talosintel.com/reports/TALOS-2015-0062/ExploitThird Party Advisory
- http://support.ntp.org/bin/view/Main/NtpBug2918Vendor Advisory
- http://support.ntp.org/bin/view/Main/SecurityNoticeRelease NotesVendor Advisory
- http://www.talosintel.com/reports/TALOS-2015-0062/ExploitThird Party Advisory
FAQ
What is CVE-2015-7851?
CVE-2015-7851 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such a...
How severe is CVE-2015-7851?
CVE-2015-7851 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-7851?
Check the references section above for vendor advisories and patch information. Affected products include: Ntp Ntp.