316 matches found
Design/Logic Flaw
chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service uninitialized pointer dereference and daemon crash or possibly execute arbitrary code via a large number of...
UBUNTU-CVE-2015-1821
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service chronyd crash or possibly execute arbitrary code by configuring the 1 NTP or 2 cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the...
UBUNTU-CVE-2015-1822
chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service uninitialized pointer dereference and daemon crash or possibly execute arbitrary code via a large number of...
CVE-2015-1821
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service chronyd crash or possibly execute arbitrary code by configuring the 1 NTP or 2 cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the...
CVE-2015-1822
chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service uninitialized pointer dereference and daemon crash or possibly execute arbitrary code via a large number of...
CVE-2015-1822
Chrony CVE-2015-1822 affects chrony before 1.31.1, where the last “next” pointer is not initialized when saving unacknowledged replies to authenticated command requests. This uninitialized pointer can cause a denial of service (daemon crash) and may allow arbitrary code execution under heavy comm...
CVE-2015-1821
CVE-2015-1821 affects the chrony project (chronyd/chronyc). The issue is an out-of-bounds write flaw in how chrony stores certain addresses when configuring NTP or cmdmon access, triggered by a subnet size not divisible by four and an address with a nonzero bit in the subnet remainder. This can a...
CVE-2015-1821
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service chronyd crash or possibly execute arbitrary code by configuring the 1 NTP or 2 cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the...
CVE-2015-1822
chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service uninitialized pointer dereference and daemon crash or possibly execute arbitrary code via a large number of...
Chrony Memory Corruption Vulnerability
Chrony is a tool for computer time synchronization that implements the NTP protocol and can be used as both a client-side and a server-side program, which is particularly suitable for maintaining computer time accuracy in environments without network connectivity. Chrony has uninitialized pointer...
Debian DSA-3222-1 : chrony - security update
Miroslav Lichvar of Red Hat discovered multiple vulnerabilities in chrony, an alternative NTP client and server : - CVE-2015-1821 Using particular address/subnet pairs when configuring access control would cause an invalid memory write. This could allow attackers to cause a denial of service cras...
Debian DLA-193-1 : chrony security update
CVE-2015-1853 : Protect authenticated symmetric NTP associations against DoS attacks. An attacker knowing that NTP hosts A and B are peering with each other symmetric association can send a packet with random timestamps to host A with source address of B which will set the NTP state variables on ...
[SECURITY] [DLA 193-1] chrony security update
Package : chrony Version : 1.24-3+squeeze2 CVE ID : CVE-2015-1821 CVE-2015-1822 CVE-2015-1853 Debian Bug : 782160 CVE-2015-1853: Protect authenticated symmetric NTP associations against DoS attacks. An attacker knowing that NTP hosts A and B are peering with each other symmetric association can...
[SECURITY] [DSA 3222-1] chrony security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3222-1 [email protected] http://www.debian.org/security/ Alessandro Ghedini April 12, 2015 http://www.debian.org/security/faq -...
Debian Security Advisory DSA 3222-1 (chrony - security update)
Miroslav Lichvar of Red Hat discovered multiple vulnerabilities in chrony, an alternative NTP client and server: CVE-2015-1821 Using particular address/subnet pairs when configuring access control would cause an invalid memory write. This could allow attackers to cause a denial of service crash o...
PT-2015-5458 · Chrony +3 · Chrony +3
Name of the Vulnerable Software and Affected Versions: chrony versions prior to 1.31.1 Description: The issue allows remote authenticated users to cause a denial of service or possibly execute arbitrary code by configuring NTP or cmdmon access with a subnet size that is indivisible by four and an...
PT-2015-5459 · Chrony +3 · Chrony +3
Name of the Vulnerable Software and Affected Versions: chrony versions prior to 1.31.1 Description: The issue allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via a large number of command requests, due to the failure to initialize the last "next"...
PT-2019-7172 · Chrony +3 · Chrony +3
Name of the Vulnerable Software and Affected Versions: chrony versions prior to 1.31.1 Description: The issue allows remote attackers with knowledge of NTP peering to cause a denial of service, specifically the inability to synchronize, by sending crafted NTP data packets with random timestamps i...