CVE-2012-4502 Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command re...
MediumCVSS 5.0
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to the PKL_CommandLength function or crafted (3) RPY_SUBNETS_ACCESSED, (4) RPY_CLIENT_ACCESSES, (5) RPY_CLIENT_ACCESSES_BY_INDEX, or (6) RPY_MANUAL_LIST command reply to the PKL_ReplyLength function, which triggers an out-of-bounds read or buffer overflow. NOTE: versions 1.27 and 1.28 do not require authentication to exploit.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/chrony(Debian:12) | < 1.29-1 | 1.29-1 |
| debian/chrony(Debian:13) | < 1.29-1 | 1.29-1 |
| debian/chrony(Debian:14) | < 1.29-1 | 1.29-1 |
| tuxfamily chrony | <= 1.28 | No fix listed |
| tuxfamily chrony | = 1.0 | No fix listed |
| tuxfamily chrony | = 1.1 | No fix listed |
| tuxfamily chrony | = 1.18 | No fix listed |
| tuxfamily chrony | = 1.19 | No fix listed |
| tuxfamily chrony | = 1.19.99.1 | No fix listed |
| tuxfamily chrony | = 1.19.99.2 | No fix listed |
| tuxfamily chrony | = 1.19.99.3 | No fix listed |
| tuxfamily chrony | = 1.20 | No fix listed |
| tuxfamily chrony | = 1.21 | No fix listed |
| tuxfamily chrony | = 1.21-pre1 | No fix listed |
| tuxfamily chrony | = 1.23 | No fix listed |
| tuxfamily chrony | = 1.23-pre1 | No fix listed |
| tuxfamily chrony | = 1.23.1 | No fix listed |
| tuxfamily chrony | = 1.24 | No fix listed |
| tuxfamily chrony | = 1.24-pre1 | No fix listed |
| tuxfamily chrony | = 1.25 | No fix listed |
| tuxfamily chrony | = 1.25-pre1 | No fix listed |
| tuxfamily chrony | = 1.25-pre2 | No fix listed |
| tuxfamily chrony | = 1.26 | No fix listed |
| tuxfamily chrony | = 1.26-pre1 | No fix listed |
| tuxfamily chrony | = 1.27 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| tuxfamily chrony | = 1.27-pre1 | No fix listed |
| tuxfamily chrony | = 1.28-pre1 | No fix listed |
References
- Debian Security Tracker CVE-2012-4502 vendor-advisory
- git.tuxfamily.org
- [chrony-announce] 20130808 chrony-1.29 released (security) mailing-list patch vendor-advisory
- [oss-security] 20130809 [Not a CVE request, just notification] CVE-2012-4502, CVE-2012-4503 -- Two security flaws fixed in Chrony v1.29 mailing-list patch
- DSA-2760 vendor-advisory
- bugzilla.redhat.com patch
- bugs.debian.org issue-tracking