Package "chrony"

Name: chrony


Set the computer clock from time servers on the Net

Latest version: 1.29-1ubuntu0.1
Release: trusty (14.04)
Level: updates
Repository: universe
Homepage: http://chrony.tuxfamily.org


Save this URL for the latest version of "chrony": https://www.ubuntuupdates.org/chrony

Download "chrony"

Other versions of "chrony" in Trusty

Repository Area Version
base universe 1.29-1
security universe 1.29-1ubuntu0.1


Version: 1.29-1ubuntu0.1 2018-12-06 20:07:04 UTC

  chrony (1.29-1ubuntu0.1) trusty-security; urgency=medium

  * SECURITY UPDATE: Heap-based buffer overflow
    - debian/patches/CVE-2015-1821.patch: Fix access configuration with
      subnet size indivisible by 4.
    - CVE-2015-1821
  * SECURITY UPDATE: DoS (uninitialized pointer dereference and daemon
    crash) or possibly execute arbitrary code via a large number of
    command requests.
    - debian/patches/CVE-2015-1822.patch: Fix initialization of allocated
      reply slots.
    - CVE-2015-1822
  * SECURITY UPDATE: Authentication doesn't protect symmetric associations
    against DoS attacks
    - debian/patches/CVE-2015-1853.patch: Protect authenticated symmetric
      associations against DoS attacks.
    - CVE-2015-1853
  * SECURITY UPDATE: Remote attackers to conduct impersonation attacks via
    an arbitrary trusted key, aka a "skeleton key".
    - debian/patches/CVE-2016-1567.patch: restrict authentication of
      server/peer to specified key.
    - CVE-2016-1567

 -- Eduardo Barretto <email address hidden> Wed, 05 Dec 2018 17:57:24 -0200

CVE-2015-1821 Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute
CVE-2015-1822 chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenti
CVE-2015-1853 authentication doesn't protect symmetric associations against DoS attacks
CVE-2016-1567 chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote att

About   -   Send Feedback to @ubuntu_updates