Bug 1274260 (CVE-2015-7851)

Summary:	CVE-2015-7851 ntp: saveconfig directory traversal vulnerability
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mlichvar, sardella, slawomir
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ntp 4.2.8p4	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-10-23 07:18:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1260670

Description Martin Prpič 2015-10-22 11:30:53 UTC

The following flaw was found in ntpd:

A potential path traversal vulnerability exists in the config file saving of ntpd on VMS. A specially crafted path could cause a path traversal potentially resulting in files being overwritten. An attacker could provide a malicious path to trigger this vulnerability.

External References:

http://talosintel.com/reports/TALOS-2015-0062/
http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner

Comment 1 Martin Prpič 2015-10-23 07:18:21 UTC

Statement:

This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, and 7. This issue only affected OpenVMS operating systems, which use characters other than "/" and "\" for directory separation, allowing exploitation of this flaw.

Comment 2 Martin Prpič 2015-10-23 08:21:26 UTC

Upstream patch:

https://github.com/ntp-project/ntp/commit/184516e143ce4448ddb5b9876dd372008cc779f6