The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html | x_refsource_CONFIRM |
| http://rhn.redhat.com/errata/RHSA-2016-2583.html | vendor-advisory x_refsource_REDHAT |
| http://www.securitytracker.com/id/1033951 | vdb-entry x_refsource_SECTRACK |
| http://www.securityfocus.com/bid/77278 | vdb-entry x_refsource_BID |
| http://rhn.redhat.com/errata/RHSA-2016-0780.html | vendor-advisory x_refsource_REDHAT |
| http://support.ntp.org/bin/view/Main/NtpBug2902 | x_refsource_CONFIRM |
| http://www.debian.org/security/2015/dsa-3388 | vendor-advisory x_refsource_DEBIAN |
| https://bugzilla.redhat.com/show_bug.cgi?id=1254547 | x_refsource_CONFIRM |
| https://security.gentoo.org/glsa/201607-15 | vendor-advisory x_refsource_GENTOO |
| https://security.netapp.com/advisory/ntap-20171004-0001/ | x_refsource_CONFIRM |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html | x_refsource_CONFIRM x_transferred |
| http://rhn.redhat.com/errata/RHSA-2016-2583.html | vendor-advisory x_refsource_REDHAT x_transferred |
| http://www.securitytracker.com/id/1033951 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://www.securityfocus.com/bid/77278 | vdb-entry x_refsource_BID x_transferred |
| http://rhn.redhat.com/errata/RHSA-2016-0780.html | vendor-advisory x_refsource_REDHAT x_transferred |
| http://support.ntp.org/bin/view/Main/NtpBug2902 | x_refsource_CONFIRM x_transferred |
| http://www.debian.org/security/2015/dsa-3388 | vendor-advisory x_refsource_DEBIAN x_transferred |
| https://bugzilla.redhat.com/show_bug.cgi?id=1254547 | x_refsource_CONFIRM x_transferred |
| https://security.gentoo.org/glsa/201607-15 | vendor-advisory x_refsource_GENTOO x_transferred |
| https://security.netapp.com/advisory/ntap-20171004-0001/ | x_refsource_CONFIRM x_transferred |
The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Primary | 2.0 | 4.3 | MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |