PT-2015-7688 · Ntf+5 · Ntp+6

Jonathan Gardner

·

Publicado

2015-12-31

·

Atualizado

2024-06-15

·

CVE-2015-7976

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions NTP versions 4.1.2, 4.2.x through 4.2.8p5, 4.3, 4.3.25, 4.3.70, 4.3.77
Description The issue concerns the ntpq saveconfig command, which does not properly filter special characters. This allows attackers to cause unspecified impact via a crafted filename.
Recommendations For NTP version 4.1.2, update to a version later than 4.1.2 to resolve the issue. For NTP versions 4.2.x through 4.2.8p5, update to version 4.2.8p6 or later. For NTP versions 4.3, 4.3.25, 4.3.70, 4.3.77, consider disabling the ntpq saveconfig command until a patch is available.

Exploit

Correção

DoS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

ALT-PU-2017-2335
CVE-2015-7976
OPENSUSE-SU-2016_1292-1
OPENSUSE-SU-2024:10181-1
SUSE-SU-2016:1175-1
SUSE-SU-2016:1177-1
SUSE-SU-2016:1247-1
SUSE-SU-2016:1311-1
USN-3096-1

Produtos afetados

Alt Linux
Cisco Ios Xr
Cisco Nexus
Freebsd
Ntp
Suse
Ubuntu