CVE-2015-7851

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, and 7. This issue only affected OpenVMS operating systems, which use characters other than "/" and "" for directory separation, allowing exploitation of this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.