Bug 1300268 (CVE-2015-7976)
Summary: | CVE-2015-7976 ntp: 'ntpq saveconfig' command allows dangerous characters in filenames | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Martin Prpič <mprpic> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED WONTFIX | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | unspecified | CC: | mlichvar, sardella |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | ntp 4.2.8p6 | Doc Type: | Bug Fix |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2016-01-20 14:34:52 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1300277 | ||
Bug Blocks: | 1297474 |
Description
Martin Prpič
2016-01-20 11:42:08 UTC
External References: http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit http://www.talosintel.com/reports/TALOS-2016-0073/ Created ntp tracking bugs for this issue: Affects: fedora-all [bug 1300277] Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. Mitigation: Use the 'restrict default nomodify' directive in ntp.conf to disable modification of ntp.conf via the ntpq command. |