Is CVE-2015-7976 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-7976 being exploited in the wild.

How severe is CVE-2015-7976?

Medium severity, with a CVSS score of 4.3, published 30 January 2017.

Which products and versions are affected?

NTP Project NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, 4.3.77.

Is there a fix for CVE-2015-7976?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2015-7976 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2015-7976?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-7976: NTP ntpq improper input validation in saveconfig command

CVE-2015-7976 · Severity: medium · CVSS 4.3 · Published 2017-01-30

A vulnerability exists in the Network Time Protocol (NTP) service, which is used to synchronize clocks across computer networks. An attacker with basic access could use a specially crafted filename in a configuration command to cause unintended behavior. This could potentially allow unauthorized changes to system files or configuration, impacting the integrity of the server.

Quick answers

Is CVE-2015-7976 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-7976 being exploited in the wild.
How severe is CVE-2015-7976?: Medium severity, with a CVSS score of 4.3, published 30 January 2017.
Which products and versions are affected?: NTP Project NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, 4.3.77.
Is there a fix for CVE-2015-7976?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2015-7976 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2015-7976?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ntpq 'saveconfig' command in multiple versions of NTP fails to properly sanitize or filter special characters in filenames. An authenticated remote attacker can exploit this by providing a maliciously crafted filename to the command. This vulnerability is classified under CWE-254 (Security Features) and can lead to unauthorized file modification or other unspecified impacts. The issue is resolved in NTP version 4.2.8p6 and later.

Affected products

NTP Project NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, 4.3.77

Timeline

2016-01-20: advisory: Vendor advisory (NTP Bug 2938) published
2017-01-30: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.