CVE-2016-0727

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/141913/NTP-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/81552Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1034808Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-3096-1Vendor Advisory
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1528050Issue Tracking, Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1382369Issue Tracking
http://packetstormsecurity.com/files/141913/NTP-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/81552Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1034808Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-3096-1Vendor Advisory
https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1528050Issue Tracking, Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1382369Issue Tracking

Timeline

Published: Apr 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-07287.8The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain CVE-2016-07299.8Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xe CVE-2016-07314.9The File Browser View in Apache Ambari before 2.2.1 allows remote authenticated administrators to read arbitrary files via a file: URL in th CVE-2016-07328.8The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when config CVE-2016-07339.8The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attack CVE-2016-07346.1The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easie CVE-2016-07358.8Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveragin CVE-2016-07367.5In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly CVE-2016-07377.5OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of CVE-2016-07387.5OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, whic CVE-2016-07395.9libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key ex CVE-2016-07406.5Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite