Every CVE Search/ Get API key

CVE-2015-7851

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP...

6.5 MediumFix available

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

3.94%Up 2.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

Record
CVE-2015-7851
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

Record
CVE-2015-7851
Updated
2026-11-02
EUVDEUVD-2015-7749 No score

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

Record
EUVD-2015-7749
Updated
2026-11-03
GitHub AdvisoriesGHSA-qp94-wj83-fxfq No score

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP...

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

Record
GHSA-qp94-wj83-fxfq
Updated
2026-11-02
OSV 6.5

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

Record
CVE-2015-7851
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2015-7851 6.5

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

Record
DEBIAN-CVE-2015-7851
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:10181-1 No score

ntp-4.2.8p9-1.1 on GA media

These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10181-1
Updated
2026-11-02
OSVSUSE-SU-2015:2058-1 No score

Security update for ntp

This ntp update provides the following security and non security fixes:

  • Update to 4.2.8p4 to fix several security issues (bsc#951608):
    • CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK
    • CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values
    • CVE-2015-7854: Password Length Memory Corruption Vulnerability
    • CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow
    • CVE-2015-7852 ntpq atoascii() Memory Corruption Vulnerability
    • CVE-2015-7851 saveconfig Directory Traversal Vulnerability
    • CVE-2015-7850 remote config logfile-keyfile
    • CVE-2015-7849 trusted key use-after-free
    • CVE-2015-7848 mode 7 loop counter underrun
    • CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC
    • CVE-2015-7703 configuration directives 'pidfile' and 'driftfile' should only be allowed locally
    • CVE-2015-7704, CVE-2015-7705 Clients that receive a KoD should validate the origin timestamp field
    • CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 Incomplete autokey data packet length checks
  • Use ntpq instead of deprecated ntpdc in start-ntpd (bnc#936327).
  • Add a controlkey to ntp.conf to make the above work.
  • Improve runtime configuration:
    • Read keytype from ntp.conf
    • Don't write ntp keys to syslog.
  • Don't let 'keysdir' lines in ntp.conf trigger the 'keys' parser.
  • Fix the comment regarding addserver in ntp.conf (bnc#910063).
  • Remove ntp.1.gz, it wasn't installed anymore.
  • Remove ntp-4.2.7-rh-manpages.tar.gz and only keep ntptime.8.gz. The rest is partially irrelevant, partially redundant and potentially outdated (bsc#942587).
  • Remove 'kod' from the restrict line in ntp.conf (bsc#944300).
  • Use SHA1 instead of MD5 for symmetric keys (bsc#905885).
  • Require perl-Socket6 (bsc#942441).
  • Fix incomplete backporting of 'rcntp ntptimemset'.
Record
SUSE-SU-2015:2058-1
Updated
2026-11-02
OSVSUSE-SU-2016:1247-1 No score

Security update for ntp

ntp was updated to version 4.2.8p6 to fix 28 security issues.

Major functional changes:

  • The 'sntp' commandline tool changed its option handling in a major way, some options have been renamed or dropped.
  • 'controlkey 1' is added during update to ntp.conf to allow sntp to work.
  • The local clock is being disabled during update.
  • ntpd is no longer running chrooted.

Other functional changes:

  • ntp-signd is installed.
  • 'enable mode7' can be added to the configuration to allow ntdpc to work as compatibility mode option.
  • 'kod' was removed from the default restrictions.
  • SHA1 keys are used by default instead of MD5 keys.

Also yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837)

These security issues were fixed:

  • CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).
  • CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).
  • CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).
  • CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).
  • CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).
  • CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).
  • CVE-2015-7975: nextvar() missing length check (bsc#962988).
  • CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).
  • CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).
  • CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).
  • CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).
  • CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).
  • CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608).
  • CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608).
  • CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608).
  • CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608).
  • CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608).
  • CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608).
  • CVE-2015-7850: remote config logfile-keyfile (bsc#951608).
  • CVE-2015-7849: trusted key use-after-free (bsc#951608).
  • CVE-2015-7848: mode 7 loop counter underrun (bsc#951608).
  • CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608).
  • CVE-2015-7703: configuration directives 'pidfile' and 'driftfile' should only be allowed locally (bsc#951608).
  • CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608).
  • CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608).

These non-security issues were fixed:

  • fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive.
  • bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail.
  • bsc#782060: Speedup ntpq.
  • bsc#916617: Add /var/db/ntp-kod.
  • bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.
  • bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.
  • Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.
  • Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq.
  • bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution.
  • bsc#905885: Use SHA1 instead of MD5 for symmetric keys.
  • Improve runtime configuration:
    • Read keytype from ntp.conf
    • Don't write ntp keys to syslog. -…
Record
SUSE-SU-2016:1247-1
Updated
2026-11-02
OSVSUSE-SU-2016:1311-1 No score

Security update for ntp

This network time protocol server ntp was updated to 4.2.8p6 to fix the following issues:

Also yast2-ntp-client was updated to match some sntp syntax changes. (bsc#937837)

Major functional changes:

  • The 'sntp' commandline tool changed its option handling in a major way.
  • 'controlkey 1' is added during update to ntp.conf to allow sntp to work.
  • The local clock is being disabled during update.
  • ntpd is no longer running chrooted.

Other functional changes:

  • ntp-signd is installed.
  • 'enable mode7' can be added to the configuration to allow ntdpc to work as compatibility mode option.
  • 'kod' was removed from the default restrictions.
  • SHA1 keys are used by default instead of MD5 keys.

These security issues were fixed:

  • CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216).
  • CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).
  • CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).
  • CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).
  • CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).
  • CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).
  • CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames (bsc#962802).
  • CVE-2015-7975: nextvar() missing length check (bsc#962988).
  • CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers (bsc#962960).
  • CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).
  • CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).
  • CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).
  • CVE-2015-5300: MITM attacker could have forced ntpd to make a step larger than the panic threshold (bsc#951629).
  • CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#951608).
  • CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#951608).
  • CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#951608).
  • CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#951608).
  • CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#951608).
  • CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#951608).
  • CVE-2015-7850: remote config logfile-keyfile (bsc#951608).
  • CVE-2015-7849: trusted key use-after-free (bsc#951608).
  • CVE-2015-7848: mode 7 loop counter underrun (bsc#951608).
  • CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#951608).
  • CVE-2015-7703: configuration directives 'pidfile' and 'driftfile' should only be allowed locally (bsc#951608).
  • CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#951608).
  • CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete autokey data packet length checks (bsc#951608).

These non-security issues were fixed:

  • fate#320758 bsc#975981: Enable compile-time support for MS-SNTP (--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added the authreg directive.
  • bsc#962318: Call /usr/sbin/sntp with full path to synchronize in start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which caused the synchronization to fail.
  • bsc#782060: Speedup ntpq.
  • bsc#916617: Add /var/db/ntp-kod.
  • bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen quite a lot on loaded systems.
  • bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.
  • Add ntp-fork.patch and build with threads disabled to allow name resolution even when running chrooted.
  • Add a controlkey line to /etc/ntp.conf if one does not already exist to allow runtime configuuration via ntpq.
  • bsc#946386: Temporarily disable memlock to avoid problems due to high memory usage during name resolution.
  • bsc#905885: Use SHA1 instead of MD5 for symmetric keys.
  • Improve runtime…
Record
SUSE-SU-2016:1311-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ntp
Debian:11
 before 1:4.2.8p4+dfsg-1
1:4.2.8p4+dfsg-1
ntp
Debian:6.0
From an advisory covering 16 CVEs
 before 1:4.2.6.p2+dfsg-1+deb6u4, plus listed versions
1:4.2.6.p2+dfsg-1
1:4.2.6.p2+dfsg-1+deb6u4
ntp
Debian:7
From an advisory covering 16 CVEs
 before 1:4.2.6.p5+dfsg-2+deb7u6, plus listed versions
1:4.2.6.p5+dfsg-21:4.2.6.p5+dfsg-2+deb7u11:4.2.6.p5+dfsg-2+deb7u21:4.2.6.p5+dfsg-2+deb7u31:4.2.6.p5+dfsg-2+deb7u41:4.2.6.p5+dfsg-2+deb7u5
1:4.2.6.p5+dfsg-2+deb7u6
ntp
Debian:8
From an advisory covering 16 CVEs
 before 1:4.2.6.p5+dfsg-7+deb8u1, plus listed versions
1:4.2.6.p5+dfsg-7
1:4.2.6.p5+dfsg-7+deb8u1
ntp
SUSE:Linux Enterprise Desktop 11 SP4
From an advisory covering 16 CVEs
 before 4.2.8p4-5.1
4.2.8p4-5.1
ntp
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 16 CVEs
 before 4.2.8p4-5.1
4.2.8p4-5.1
ntp
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 16 CVEs
 before 4.2.8p4-5.1
4.2.8p4-5.1
ntp
SUSE:Linux Enterprise Desktop 12
From an advisory covering 28 CVEs
 before 4.2.8p6-46.5.2
4.2.8p6-46.5.2
yast2-ntp-client
SUSE:Linux Enterprise Desktop 12
From an advisory covering 28 CVEs
 before 3.1.12.4-8.2
3.1.12.4-8.2
yast2-ntp-client
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 28 CVEs
 before 3.1.12.4-8.2
3.1.12.4-8.2
Show 12 moreShow less
Affected packages
PackageAffectedFixed
ntp
SUSE:Linux Enterprise Server 12
From an advisory covering 28 CVEs
 before 4.2.8p6-46.5.2
4.2.8p6-46.5.2
yast2-ntp-client
SUSE:Linux Enterprise Server 12
From an advisory covering 28 CVEs
 before 3.1.12.4-8.2
3.1.12.4-8.2
ntp
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 28 CVEs
 before 4.2.8p6-46.5.2
4.2.8p6-46.5.2
yast2-ntp-client
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 28 CVEs
 before 3.1.12.4-8.2
3.1.12.4-8.2
ntp
SUSE:OpenStack Cloud 5
From an advisory covering 30 CVEs
 before 4.2.8p6-41.1
4.2.8p6-41.1
ntp
SUSE:Manager 2.1
From an advisory covering 30 CVEs
 before 4.2.8p6-41.1
4.2.8p6-41.1
ntp
SUSE:Manager Proxy 2.1
From an advisory covering 30 CVEs
 before 4.2.8p6-41.1
4.2.8p6-41.1
ntp
SUSE:Linux Enterprise Server 11 SP2-LTSS
From an advisory covering 30 CVEs
 before 4.2.8p6-41.1
4.2.8p6-41.1
yast2-ntp-client
SUSE:Linux Enterprise Server 11 SP2-LTSS
From an advisory covering 30 CVEs
 before 2.17.14.1-1.12.1
2.17.14.1-1.12.1
ntp
SUSE:Linux Enterprise Server 11 SP3-LTSS
From an advisory covering 30 CVEs
 before 4.2.8p6-41.1
4.2.8p6-41.1
ntp
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 30 CVEs
 before 4.2.8p6-41.1
4.2.8p6-41.1
ntp
openSUSE:Tumbleweed
From an advisory covering 60 CVEs
 before 4.2.8p9-1.1
4.2.8p9-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-7851 is a medium vulnerability (CVSS 6.5) in Ntp, published October 28, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.94%, the 90th percentile. Fixed in ntp 1:4.2.8p4+dfsg-1.

References

Show 103 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open