NetSight
IP …
high7.5

CVE-2015-7703

The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allow…

Impact

The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.

Affected products

VendorProductAffected versions
NtpNtp
from 4.2.0 before 4.2.8
from 4.3.0 before 4.3.77
Version 4.2.8
OracleLinux
Version 6
DebianDebian Linux
Versions 7.0, 8.0, 9.0
NetappOncommand Performance Manager
All versions
NetappOncommand Unified Manager
All versions
NetappClustered Data Ontap
All versions
NetappData Ontap
All versions
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Server Eus
Versions 7.3, 7.4, 7.5, 7.6, 7.7
RedhatEnterprise Linux Server Tus
Versions 7.3, 7.6, 7.7

Weakness classification

CWE-20

References