CVE-2015-7703: debian debian_linux Improper Input Validation
Vulnerability summary
CVE-2015-7703 is a high (CVSS 7.5) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 3.82% chance of exploitation in the next 30 days, higher than 89.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 9 · Duplicates 2 · Related 5Timeline
- 24-07-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
3.82%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.82% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus7.3 | 7.4 | 7.6 | 7.7
- enterprise_linux_server_eus7.3 | 7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_server_tus7.3 | 7.6 | 7.7
Netapp4 products
Debian2 products
- ntp< 1:4.2.8p4+dfsg-1
- debian_linuxEOL7.0 | 8.0 | 9.0
Ntp1 product
- ntp≥ 4.2.0, < 4.2.8 | ≥ 4.3.0, < 4.3.77 | 4.2.8 | 4.2.8:p1 | 4.2.8:p1-beta1 | 4.2.8:p1-beta2 | 4.2.8:p1-beta3 | 4.2.8:p1-beta4 | 4.2.8:p1-beta5 | 4.2.8:p1-rc1 | 4.2.8:p1-rc2 | 4.2.8:p2 | 4.2.8:p2-rc1 | 4.2.8:p2-rc2 | 4.2.8:p2-rc3 | 4.2.8:p3 | 4.2.8:p3-rc1 | 4.2.8:p3-rc2 | 4.2.8:p3-rc3
Oracle1 product
- linuxEOL6
Ubuntu1 product
- ntp< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.5
6 vendors · 15 products
References
15 links- www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlX Refsource CONFIRMThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1254547X Refsource CONFIRMIssue TrackingThird Party AdvisoryVDB Entry