CVE-2015-7851

Description

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

Weakness classification

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references

• cve@mitre.org — Vendor Advisory
• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory