CVE-2010-0294 chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a syslog message for each unauthorized cmdmon packet, which allows remote attackers to cause a denial of service (disk consumption) v...
MediumCVSS 5.0
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a syslog message for each unauthorized cmdmon packet, which allows remote attackers to cause a denial of service (disk consumption) via a large number of invalid packets.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tuxfamily chrony | <= 1.23-pre1 | No fix listed |
| tuxfamily chrony | = 1.18 | No fix listed |
| tuxfamily chrony | = 1.19 | No fix listed |
| tuxfamily chrony | = 1.19-1 | No fix listed |
| tuxfamily chrony | = 1.19.99.1 | No fix listed |
| tuxfamily chrony | = 1.19.99.2 | No fix listed |
| tuxfamily chrony | = 1.19.99.3 | No fix listed |
| tuxfamily chrony | = 1.20 | No fix listed |
| tuxfamily chrony | = 1.21 | No fix listed |
| tuxfamily chrony | = 1.21-pre1 | No fix listed |
| tuxfamily chrony | = 1.24-pre1 | No fix listed |
| debian/chrony(Debian:12) | < 1.23-7 | 1.23-7 |
| debian/chrony(Debian:13) | < 1.23-7 | 1.23-7 |
| debian/chrony(Debian:14) | < 1.23-7 | 1.23-7 |
References
- chrony.tuxfamily.org patch vendor-advisory
- git.tuxfamily.org
- 38428 third-party-advisory vendor-advisory
- 38480 third-party-advisory vendor-advisory
- DSA-1992 vendor-advisory
- 38106 patch vdb-entry
- bugzilla.redhat.com
- Debian Security Tracker CVE-2010-0294 vendor-advisory