# CVE-2015-7976: NTP ntpq improper input validation in saveconfig command

Source: https://junglewise.ai/threats/cve-2015-7976-ntp-ntpq-improper-input-validation-in-saveconfig-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-30. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2015-7976 · Severity: medium · CVSS 4.3 · Published 2017-01-30

A vulnerability exists in the Network Time Protocol (NTP) service, which is used to synchronize clocks across computer networks. An attacker with basic access could use a specially crafted filename in a configuration command to cause unintended behavior. This could potentially allow unauthorized changes to system files or configuration, impacting the integrity of the server.

## Quick answers

**Is CVE-2015-7976 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-7976 being exploited in the wild.

**How severe is CVE-2015-7976?** Medium severity, with a CVSS score of 4.3, published 30 January 2017.

**Which products and versions are affected?** NTP Project NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, 4.3.77.

**Is there a fix for CVE-2015-7976?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2015-7976 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2015-7976?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ntpq 'saveconfig' command in multiple versions of NTP fails to properly sanitize or filter special characters in filenames. An authenticated remote attacker can exploit this by providing a maliciously crafted filename to the command. This vulnerability is classified under CWE-254 (Security Features) and can lead to unauthorized file modification or other unspecified impacts. The issue is resolved in NTP version 4.2.8p6 and later.

## Affected products

- NTP Project NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, 4.3.77

## Timeline

- 2016-01-20: advisory: Vendor advisory (NTP Bug 2938) published
- 2017-01-30: disclosed: NVD publication date

## References

- [http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html](http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html](http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html](http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html](http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html](http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html](http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html)
- [http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html](http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html)