CVE-2016-0727

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-04-14 · updated 2026-06-17
Weakness: CWE-264

Description

The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04

References

http://packetstormsecurity.com/files/141913/NTP-Privilege-Escalation.html
http://www.securityfocus.com/bid/81552
http://www.securitytracker.com/id/1034808
http://www.ubuntu.com/usn/USN-3096-1
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1528050
https://bugzilla.redhat.com/show_bug.cgi?id=1382369
http://packetstormsecurity.com/files/141913/NTP-Privilege-Escalation.html
http://www.securityfocus.com/bid/81552
http://www.securitytracker.com/id/1034808
http://www.ubuntu.com/usn/USN-3096-1
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1528050
https://bugzilla.redhat.com/show_bug.cgi?id=1382369

Get alerted when CVE-2016-0727 or the next vulnerability affects your stack