CVE-2015-1853

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-1853
chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://chrony.tuxfamily.org/News.html Release Notes Vendor Advisory
https://security.gentoo.org/glsa/201507-01 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:tuxfamily:chrony:*:*:*:*:*:*:*:*
History

13 Feb 2023, 00:47

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:2241', 'name': 'https://access.redhat.com/errata/RHSA-2015:2241', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1209572', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1209572', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-1853', 'name': 'https://access.redhat.com/security/cve/CVE-2015-1853', 'tags': [], 'refsource': 'MISC'}
Summary A denial of service flaw was found in the way chrony hosts that were peering with each other authenticated themselves before updating their internal state variables. An attacker could send packets to one peer host, which could cascade to other peers, and stop the synchronization process among the reached peers. chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.

02 Feb 2023, 20:20

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/errata/RHSA-2015:2241 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1209572 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-1853 -
Summary chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets. A denial of service flaw was found in the way chrony hosts that were peering with each other authenticated themselves before updating their internal state variables. An attacker could send packets to one peer host, which could cascade to other peers, and stop the synchronization process among the reached peers.
Information

Published : 2019-12-09 19:15

Updated : 2023-12-10 13:13

NVD link : CVE-2015-1853

Mitre link : CVE-2015-1853

CVE.ORG link : CVE-2015-1853

JSON object : View

Products Affected

tuxfamily

  • chrony
CWE
NVD-CWE-Other