Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Cisco Apic | — | Upgrade to the latest version of Cisco APIC to resolve this vulnerability. | May 11, 2026 | Oct 21, 2015 |
| Cisco Ise | — | — | Oct 21, 2025 | Oct 21, 2015 |
| Debian | — | Upgrade ntp | Mar 31, 2017 | Oct 28, 2015 |
| Freebsd | — | Upgrade ntpUpgrade FreeBSDUpgrade ntp-devel | Dec 10, 2025 | Oct 21, 2015 |
| Gentoo Linux | — | Upgrade net-misc/ntp. | Oct 30, 2017 | Jul 20, 2016 |
| Ntp | — | Upgrade NTP to version 4.3.77Upgrade NTP to version 4.2.8 | Feb 23, 2023 | Jan 28, 2020 |
| Oracle Solaris | — | Upgrade service/network/ntp to version 4.2.8.6-0.175.3.6.0.1.0 on Solaris 11.3 | May 29, 2017 | May 29, 2017 |
| Suse | — | Upgrade ntpUpgrade ntp-docUpgrade yast2-ntp-client-devel-docUpgrade yast2-ntp-client | Dec 18, 2015 | Nov 20, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub