Bug 1274260 (CVE-2015-7851) - CVE-2015-7851 ntp: saveconfig directory traversal vulnerability
Summary: CVE-2015-7851 ntp: saveconfig directory traversal vulnerability
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2015-7851
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1260670
TreeView+ depends on / blocked
 
Reported: 2015-10-22 11:30 UTC by Martin Prpič
Modified: 2021-02-17 04:48 UTC (History)
3 users (show)

Fixed In Version: ntp 4.2.8p4
Clone Of:
Environment:
Last Closed: 2015-10-23 07:18:21 UTC
Embargoed:

Attachments (Terms of Use)

Description Martin Prpič 2015-10-22 11:30:53 UTC 
The following flaw was found in ntpd:

A potential path traversal vulnerability exists in the config file saving of ntpd on VMS. A specially crafted path could cause a path traversal potentially resulting in files being overwritten. An attacker could provide a malicious path to trigger this vulnerability.

External References:

http://talosintel.com/reports/TALOS-2015-0062/
http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner
Comment 1 Martin Prpič 2015-10-23 07:18:21 UTC 
Statement:

This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, and 7. This issue only affected OpenVMS operating systems, which use characters other than "/" and "\" for directory separation, allowing exploitation of this flaw.
Comment 2 Martin Prpič 2015-10-23 08:21:26 UTC 
Upstream patch:

https://github.com/ntp-project/ntp/commit/184516e143ce4448ddb5b9876dd372008cc779f6
Note You need to log in before you can comment on or make changes to this bug.