CVEvulnerability
CVE-2015-7703
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-07-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-20
Description
The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.
Affected configurations
• ntp ntp (>= 4.2.0 < 4.2.8)
• ntp ntp (>= 4.3.0 < 4.3.77)
• ntp ntp 4.2.8
• oracle linux 6
• debian debian linux 7.0
• debian debian linux 8.0
• debian debian linux 9.0
• netapp oncommand performance manager
• netapp oncommand unified manager
• netapp clustered data ontap
• netapp data ontap
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 7.3
• redhat enterprise linux server aus 7.4
• redhat enterprise linux server aus 7.6
• redhat enterprise linux server aus 7.7
• redhat enterprise linux server eus 7.3
• redhat enterprise linux server eus 7.4
• redhat enterprise linux server eus 7.5
• redhat enterprise linux server eus 7.6
• redhat enterprise linux server eus 7.7
• redhat enterprise linux server tus 7.3
• redhat enterprise linux server tus 7.6
• redhat enterprise linux server tus 7.7
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://rhn.redhat.com/errata/RHSA-2016-0780.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2583.html Third Party Advisory
- http://support.ntp.org/bin/view/Main/NtpBug2902 Vendor Advisory
- http://www.debian.org/security/2015/dsa-3388 Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html Third Party Advisory
- http://www.securityfocus.com/bid/77278 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033951 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1254547 Issue Tracking, Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201607-15 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20171004-0001/ Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0780.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2583.html Third Party Advisory
- http://support.ntp.org/bin/view/Main/NtpBug2902 Vendor Advisory
- http://www.debian.org/security/2015/dsa-3388 Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html Third Party Advisory
- http://www.securityfocus.com/bid/77278 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033951 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1254547 Issue Tracking, Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201607-15 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20171004-0001/ Third Party Advisory