Read the docs
TI-2015-06400 Aliases CVE-2015-7703GHSA-p9hx-j72m-8cf4

The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x…

Priority LOW 39CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 16 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.

Why it matters now

EPSS 0.03823 90th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 16 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*4.2.0 to before 4.2.8; 4.3.0 to before 4.3.77VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:*4.2.8VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:*4.2.8 p1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:*4.2.8 p1-beta1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:*4.2.8 p1-beta2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:*4.2.8 p1-beta3VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:*4.2.8 p1-beta4VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:*4.2.8 p1-beta5VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:*4.2.8 p1-rc1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:*4.2.8 p1-rc2VulnerableNTP Project
  • cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:* Versions 4.2.0 to before 4.2.8; 4.3.0 to before 4.3.77 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:* Versions 4.2.8 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:* Versions 4.2.8 p1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:* Versions 4.2.8 p1-beta1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:* Versions 4.2.8 p1-beta2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:* Versions 4.2.8 p1-beta3 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:* Versions 4.2.8 p1-beta4 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:* Versions 4.2.8 p1-beta5 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:* Versions 4.2.8 p1-rc1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:* Versions 4.2.8 p1-rc2 Vulnerable ·NTP Project
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:*4.2.8 p2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:*4.2.8 p2-rc1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:*4.2.8 p2-rc2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:*4.2.8 p2-rc3VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:*4.2.8 p3VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:*4.2.8 p3-rc1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:*4.2.8 p3-rc2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:*4.2.8 p3-rc3VulnerableNTP Project
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*6VulnerableOracle
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*7.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:clustered_data_ontap:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:netapp:data_ontap:-:*:*:*:*:7-mode:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*7.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:* Versions 4.2.8 p2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:* Versions 4.2.8 p2-rc1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:* Versions 4.2.8 p2-rc2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:* Versions 4.2.8 p2-rc3 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:* Versions 4.2.8 p3 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:* Versions 4.2.8 p3-rc1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:* Versions 4.2.8 p3-rc2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:* Versions 4.2.8 p3-rc3 Vulnerable ·NTP Project
  • cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:* Versions 6 Vulnerable ·Oracle
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:oncommand_performance_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:clustered_data_ontap:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:netapp:data_ontap:-:*:*:*:*:7-mode:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2016:2583 Released 2016-11-03 · Red Hat rating Moderate
    ntp security and bug fix update
    • Red Hat Enterprise Linux Client (v. 7) ntp-4.2.6p5-25.el7, ntpdate-4.2.6p5-25.el7
    • Red Hat Enterprise Linux Client Optional (v. 7) ntp-doc-4.2.6p5-25.el7, ntp-perl-4.2.6p5-25.el7, sntp-4.2.6p5-25.el7
    • Red Hat Enterprise Linux ComputeNode (v. 7) ntp-4.2.6p5-25.el7, ntpdate-4.2.6p5-25.el7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) ntp-doc-4.2.6p5-25.el7, ntp-perl-4.2.6p5-25.el7, sntp-4.2.6p5-25.el7
    • Red Hat Enterprise Linux Server (v. 7) ntp-4.2.6p5-25.el7, ntpdate-4.2.6p5-25.el7
    • Red Hat Enterprise Linux Server Optional (v. 7) ntp-doc-4.2.6p5-25.el7, ntp-perl-4.2.6p5-25.el7, sntp-4.2.6p5-25.el7
    • Red Hat Enterprise Linux Workstation (v. 7) ntp-4.2.6p5-25.el7, ntpdate-4.2.6p5-25.el7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) ntp-doc-4.2.6p5-25.el7, ntp-perl-4.2.6p5-25.el7, sntp-4.2.6p5-25.el7
  • RHSA-2016:0780 Released 2016-05-10 · Red Hat rating Moderate
    ntp security and bug fix update
    • Red Hat Enterprise Linux Desktop (v. 6) ntp-4.2.6p5-10.el6, ntpdate-4.2.6p5-10.el6
    • Red Hat Enterprise Linux Desktop Optional (v. 6) ntp-doc-4.2.6p5-10.el6, ntp-perl-4.2.6p5-10.el6
    • Red Hat Enterprise Linux HPC Node (v. 6) ntp-4.2.6p5-10.el6, ntpdate-4.2.6p5-10.el6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) ntp-doc-4.2.6p5-10.el6, ntp-perl-4.2.6p5-10.el6
    • Red Hat Enterprise Linux Server (v. 6) ntp-4.2.6p5-10.el6, ntpdate-4.2.6p5-10.el6
    • Red Hat Enterprise Linux Server Optional (v. 6) ntp-doc-4.2.6p5-10.el6, ntp-perl-4.2.6p5-10.el6
    • Red Hat Enterprise Linux Workstation (v. 6) ntp-4.2.6p5-10.el6, ntpdate-4.2.6p5-10.el6
    • Red Hat Enterprise Linux Workstation Optional (v. 6) ntp-doc-4.2.6p5-10.el6, ntp-perl-4.2.6p5-10.el6

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2016:2583
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2016:2583
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2016:2583
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2016:2583
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2016:0780
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2016:0780
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2016:0780
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2016:0780
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2016:0780
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2016:2583
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2016:0780
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2016:2583
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2016:0780
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2016:2583
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2016:0780
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2016:2583

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-7703
  2. 2026-10-03 Alias added: GHSA-p9hx-j72m-8cf4
  3. 2026-10-21 EPSS moved to the 90th–95th percentile
  4. 2026-10-25 EPSS moved to the 50th–90th percentile
  5. 2026-10-27 EPSS moved to the 90th–95th percentile

References

Advisory 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences