CVE-2015-7851

MEDIUM6.5

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files

Published Jan 28, 2020

Modified 2 years ago

Details

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

References

WEB

http://support.ntp.org/bin/view/Main/NtpBug2918

WEB

http://support.ntp.org/bin/view/Main/SecurityNotice

WEB

http://www.talosintel.com/reports/TALOS-2015-0062/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2015-7851

CVSS Analysis

CVSS v3.1

6.5