TI-2020-11235 CVE-2020-14367 · GHSA-73h7-c2xm-9mrv
Link following in Chrony
Priority LOW 27
A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder.
Vulnerabilities
10 records
TI-2015-01664 CVE-2015-1853 · GHSA-gf8j-j7q8-vhh5
chrony before 1.31.1 does not properly protect state variables in authenticated symmetric…
Priority LOW 32
chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchroni…
TI-2016-01428 CVE-2016-1567 · GHSA-vwxj-hm98-qj7v
chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric…
Priority MEDIUM 41
chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, a…
TI-2015-01639 CVE-2015-1822 · GHSA-rchf-p2rm-hg6h
chrony before 1.31.1 does not initialize the last "next" pointer when saving…
Priority LOW 34
chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer derefer…
TI-2015-01638 CVE-2015-1821 · GHSA-cm73-xw9w-xqmm
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to…
Priority LOW 35
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a…
TI-2012-03845 CVE-2012-4503 · GHSA-53c9-c34f-h6w7
cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive…
Priority LOW 28
cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the handle_subnets_ac…
TI-2012-03844 CVE-2012-4502 · GHSA-93mp-m23x-f3x9
Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to…
Priority LOW 29
Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to the PKL_Com…
TI-2010-00281 CVE-2010-0294 · GHSA-87x4-2c3p-r924
chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a syslog message for…
Priority LOW 28
chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a syslog message for each unauthorized cmdmon packet, which allows remote attackers to cause a denial of service (disk consumption) via a large number of…
TI-2010-00280 CVE-2010-0293 · GHSA-3vvg-7h3p-gmv3
The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the…
Priority LOW 28
The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of service (memory consum…
TI-2010-00279 CVE-2010-0292 · GHSA-2w7g-w6qh-q8wj
The read_from_cmd_socket function in cmdmon.c in chronyd in Chrony before 1.23.1, and…
Priority LOW 26
The read_from_cmd_socket function in cmdmon.c in chronyd in Chrony before 1.23.1, and 1.24-pre1, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a spoofed cmdmon packet tha…