CVE-2015-7703

Loading...

General

Score:5.8/10.0
Severity:Medium
Category:Input Validation Error

Impact Metrics

Confidentiality:None
Integrity:Partial
Availability:Partial

Exploitability Metrics

Access Vector:Network
Access Complexity:Medium
Authentication:None

Relative vulnerabilities

CVE-2013-5211, CVE-2014-9750, CVE-2015-1798, CVE-2015-1799, CVE-2015-3405, CVE-2015-5146, CVE-2015-5194, CVE-2015-5195, CVE-2015-5196, CVE-2015-5219, CVE-2015-5300, CVE-2015-7691, CVE-2015-7692, CVE-2015-7701, CVE-2015-7702, CVE-2015-7704, CVE-2015-7705, CVE-2015-7848, CVE-2015-7849, CVE-2015-7850, CVE-2015-7851, CVE-2015-7852, CVE-2015-7853, CVE-2015-7854, CVE-2015-7855, CVE-2015-7871, CVE-2015-7973, CVE-2015-7974, CVE-2015-7975, CVE-2015-7976, CVE-2015-7977, CVE-2015-7978, CVE-2015-7979, CVE-2015-8138, CVE-2015-8139, CVE-2015-8140, CVE-2015-8158, CVE-2016-1547, CVE-2016-1548, CVE-2016-1549, CVE-2016-1550, CVE-2016-1551, CVE-2016-2516, CVE-2016-2517, CVE-2016-2518, CVE-2016-2519, CVE-2016-4953, CVE-2016-4954, CVE-2016-4955, CVE-2016-4956, CVE-2016-4957

Published on 24/07/17 - Updated on 18/05/18

Description

The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.

Category: Input Validation Error

CWE-20 (Input Validation)
The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.

Security Notices

US National Vulnerability DatabaseCVE-2015-7703
Amazon Linux ALAS-2015-593
Agence Nationale de la Sécurité des Systèmes d'Information CERTFR-2015-AVI-449
Arch Linux ASA-201510-14
CentOS CESA-2016:0780, CESA-2016:2583
Debian DSA-3388-1
Debian LTSDLA-335-1
Oracle Linux ELSA-2016-0780, ELSA-2016-2583
Redhat RHSA-2016:0780, RHSA-2016:2583
Renater 2015/VULN222, 2015/VULN224
SUSE SUSE-SU-2015:2058, SUSE-SU-2016:1247, SUSE-SU-2016:1311, SUSE-SU-2016:1912
Ubuntu USN-2783-1

Exploits

No exploits available for this CVE in our database.

Relative technologies

VendorProduct
ntpntp

Share this vulnerability with:

Twitter Facebook LinkedIn Mail