Bug 1274260 - (CVE-2015-7851) CVE-2015-7851 ntp: saveconfig directory traversal vulnerability
CVE-2015-7851 ntp: saveconfig directory traversal vulnerability
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20151021,repor...
: Security
Depends On:
Blocks: 1260670
  Show dependency treegraph
 
Reported: 2015-10-22 07:30 EDT by Martin Prpič
Modified: 2015-10-23 04:21 EDT (History)
3 users (show)

See Also:
Fixed In Version: ntp 4.2.8p4
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-10-23 03:18:21 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Martin Prpič 2015-10-22 07:30:53 EDT
The following flaw was found in ntpd:

A potential path traversal vulnerability exists in the config file saving of ntpd on VMS. A specially crafted path could cause a path traversal potentially resulting in files being overwritten. An attacker could provide a malicious path to trigger this vulnerability.

External References:

http://talosintel.com/reports/TALOS-2015-0062/
http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner
Comment 1 Martin Prpič 2015-10-23 03:18:21 EDT
Statement:

This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, and 7. This issue only affected OpenVMS operating systems, which use characters other than "/" and "\" for directory separation, allowing exploitation of this flaw.

Note You need to log in before you can comment on or make changes to this bug.