CVE-2015-7851

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-01-28 · updated 2026-06-17
Weakness: CWE-22

Description

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

Affected products

NTP: from 4.2.0 before 4.2.8; from 4.3.0 before 4.3.77; 4.2.8-p1, 4.2.8-p1-beta1, 4.2.8-p1-beta2, 4.2.8-p1-beta3, 4.2.8-p1-beta4, 4.2.8-p1-beta5 (+10) — fixed in 4.2.8, 4.3.77

How to fix

Upgrade to a fixed version: NTP 4.2.8, 4.3.77. Check the vendor advisory for mitigations.

References

http://support.ntp.org/bin/view/Main/NtpBug2918
http://support.ntp.org/bin/view/Main/SecurityNotice
http://www.talosintel.com/reports/TALOS-2015-0062/
http://support.ntp.org/bin/view/Main/NtpBug2918
http://support.ntp.org/bin/view/Main/SecurityNotice
http://www.talosintel.com/reports/TALOS-2015-0062/

Get alerted when CVE-2015-7851 or the next vulnerability affects your stack