chrony - denial of service

Several vulnerabilities have been discovered in chrony, a pair of programs
which are used to maintain the accuracy of the system clock on a computer.
This issues are similar to the NTP security flaw CVE-2009-3563. The Common
Vulnerabilities and Exposures project identifies the following problems:

• CVE-2010-0292
  chronyd replies to all cmdmon packets with NOHOSTACCESS messages even for
  unauthorized hosts. An attacker can abuse this behaviour to force two
  chronyd instances to play packet ping-pong by sending such a packet with
  spoofed source address and port. This results in high CPU and network
  usage and thus denial of service conditions.
• CVE-2010-0293
  The client logging facility of chronyd doesn’t limit memory that is used
  to store client information. An attacker can cause chronyd to allocate
  large amounts of memory by sending NTP or cmdmon packets with spoofed
  source addresses resulting in memory exhaustion.
• CVE-2010-0294
  chronyd lacks of a rate limit control to the syslog facility when logging
  received packets from unauthorized hosts. This allows an attacker to
  cause denial of service conditions via filling up the logs and thus disk
  space by repeatedly sending invalid cmdmon packets.

For the oldstable distribution (etch), this problem has been fixed in
version 1.21z-5+etch1.

For the stable distribution (lenny), this problem has been fixed in
version 1.23-6+lenny1.

For the testing (squeeze) and unstable (sid) distribution, this problem
will be fixed soon.

We recommend that you upgrade your chrony packages.