CVE-2016-1567
Published: 26 January 2016
chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
From the Ubuntu Security Team
Matt Street discovered that chrony doesn't verify peer associations of symmetric keys. A remote attacker could use this vulnerability impersonate another user.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
chrony Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(3.1-5)
|
| bionic |
Not vulnerable
(3.2-4ubuntu1)
|
|
| cosmic |
Not vulnerable
(3.2-4ubuntu1)
|
|
| precise |
Ignored
(reached end-of-life)
|
|
| trusty |
Released
(1.29-1ubuntu0.1)
|
|
| upstream |
Released
(2.2.1, 1.31.2)
|
|
| vivid |
Ignored
(reached end-of-life)
|
|
| wily |
Ignored
(reached end-of-life)
|
|
| xenial |
Released
(2.1.1-1ubuntu0.1)
|
|
| yakkety |
Ignored
(reached end-of-life)
|
|
| zesty |
Ignored
(reached end-of-life)
|
|
|
Patches: upstream: https://git.tuxfamily.org/chrony/chrony.git/commit/?id=a78bf9725a7b481 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.1 |
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1567
- http://www.talosintel.com/reports/TALOS-2016-0071/
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175969.html
- http://chrony.tuxfamily.org/news.html#_20_jan_2016_chrony_2_2_1_and_chrony_1_31_2_released
- NVD
- Launchpad
- Debian