VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jan 30, 2017· Updated May 13, 2026

CVE-2015-7976

CVE-2015-7976

Description

The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3.x fails to sanitize special characters in filenames, potentially allowing arbitrary file overwrite.

Vulnerability

The bug resides in the ntpq saveconfig command, which writes the current NTP configuration to a file. The command does not properly filter special characters (e.g., directory traversal or shell metacharacters) in the filename argument. This affects NTP versions 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 [1][2][3][4]. An attacker must have access to issue the saveconfig command, typically requiring authentication to ntpq.

Exploitation

An attacker with ntpq access can craft a filename containing dangerous characters such as ../ or shell metacharacters. When the saveconfig command is executed with this filename, the daemon writes the configuration to the unintended path, potentially overwriting arbitrary files. No user interaction beyond issuing the command is required [3][4].

Impact

Successful exploitation allows an attacker to overwrite arbitrary files on the system, which could lead to privilege escalation, denial of service, or other unauthorized changes. The impact is file write compromise, though remote code execution is not demonstrated in the references [3][4].

Mitigation

The vulnerability is fixed in NTP version 4.2.8p6, released on 2016-01-19 [1][2]. Users should upgrade to 4.2.8p6 or later. Workarounds include restricting access to the ntpq saveconfig command via configuration or network access controls. Cisco, FreeBSD, and Ubuntu have released updates addressing this issue [1][2][4]. No KEV listing is available.

References
  1. Cisco Security Advisory: Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: January 2016
  2. https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc
  3. CERT/CC Vulnerability Note VU#718152
  4. USN-3096-1: NTP vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

133

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

17

News mentions

0

No linked articles in our index yet.