CVE-2015-1821
chrony: Heap out of bound write in address filter
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the subnet remainder.
Desbordamiento de buffer basado en memoria dinámica en chrony anterior a 1.31.1 permite a usuarios remotos autenticados causar una denegación de servicio (caída de chronyd) o posiblemente ejecutar código arbitrario mediante la configuración del acceso (1) NTP o (2) cmdmon con un tamaño subnet que resulta indivisible por cuatro y una dirección con un bit no cero en el restante de subnet.
An out-of-bounds write flaw was found in the way Chrony stored certain addresses when configuring NTP or cmdmon access. An attacker that has the command key and is allowed to access cmdmon (only localhost is allowed by default) could use this flaw to crash chronyd or, possibly, execute arbitrary code with the privileges of the chronyd process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-02-17 CVE Reserved
- 2015-04-13 CVE Published
- 2023-05-16 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-787: Out-of-bounds Write
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html | X_refsource_confirm |
|
| http://www.securityfocus.com/bid/73955 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2015/04/msg00002.html | 2023-02-13 |
| URL | Date | SRC |
|---|---|---|
| http://www.debian.org/security/2015/dsa-3222 | 2023-02-13 | |
| https://security.gentoo.org/glsa/201507-01 | 2023-02-13 | |
| https://access.redhat.com/security/cve/CVE-2015-1821 | 2015-11-19 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1209631 | 2015-11-19 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Tuxfamily Search vendor "Tuxfamily" | Chrony Search vendor "Tuxfamily" for product "Chrony" | <= 1.31 Search vendor "Tuxfamily" for product "Chrony" and version " <= 1.31" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 7.0 Search vendor "Debian" for product "Debian Linux" and version "7.0" | - |
Affected
| ||||||