CVE-2016-1567 chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbi...
HighCVSS 8.1
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/chrony(Debian:12) | < 2.2.1-1 | 2.2.1-1 |
| debian/chrony(Debian:13) | < 2.2.1-1 | 2.2.1-1 |
| debian/chrony(Debian:14) | < 2.2.1-1 | 2.2.1-1 |
| tuxfamily chrony | <= 1.31.1 | No fix listed |
| tuxfamily chrony | = 2.0 | No fix listed |
| tuxfamily chrony | = 2.1 | No fix listed |
| tuxfamily chrony | = 2.1.1 | No fix listed |
| tuxfamily chrony | = 2.2 | No fix listed |
References
- Debian Security Tracker CVE-2016-1567 vendor-advisory
- chrony.tuxfamily.org vendor-advisory
- FEDORA-2016-6f783d1768 vendor-advisory
- FEDORA-2016-6a0b0ab775 patch vendor-advisory
- www.talosintel.com exploit
- bugs.debian.org issue-tracking