Medium severity · published Jan 30, 2017
CVE-2015-7976
The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause…
4.3
CVSS
3.6%
EPSS
No
On KEV
Description
The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LE
Leap · Opensuse
42.1 · source: NVD
LE
Linux Enterprise Debuginfo · Suse
11; 11; 11 · source: NVD
LE
Linux Enterprise Desktop · Suse
12; 12 · source: NVD
LE
Linux Enterprise Server · Suse
10; 11; 11; 11; 12 · source: NVD
MA
Manager · Suse
2.1 · source: NVD
MP
Manager Proxy · Suse
2.1 · source: NVD
NT
Ntp · Ntp
4.1.2; through 4.2.8; 4.3.0; 4.3.1; 4.3.2; 4.3.3; +34 more · source: NVD
OP
Opensuse · Opensuse
13.2 · source: NVD
SL
Suse Linux Enterprise Server · Suse
12 · source: NVD
SO
Suse Openstack Cloud · Novell
5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7976
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7976
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
More from Suse Openstack Cloud
8.1
CVE-2016-0376
The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40),…
8.1
CVE-2016-0363
The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1…