Candidate: CVE-2015-1821
PublicDate: 2015-04-16 14:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1821
 http://git.tuxfamily.org/chrony/chrony.git/commit/?h=1.31-security&id=cf19042ecb656b8afec0cc4906e7dd3ea9266ac8
 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1821
 http://chrony.tuxfamily.org/News.html
Description:
 Heap-based buffer overflow in chrony before 1.31.1 allows remote
 authenticated users to cause a denial of service (chronyd crash) or
 possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon
 access with a subnet size that is indivisible by four and an address with a
 nonzero bit in the subnet remainder.
Ubuntu-Description:
 Miroslav Lichvár discovered a head-based buffer overflow in chrony. A remote
 attacker could use this vulnerability to cause a denial of service (crash) or
 execute arbitrary code.
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782160
Priority: medium
Discovered-by: Miroslav Lichvár
Assigned-to:
CVSS: 

Patches_chrony:
 upstream: http://git.tuxfamily.org/chrony/chrony.git/commit/?h=1.31-security&id=cf19042ecb656b8afec0cc4906e7dd3ea9266ac8
upstream_chrony: released (1.31.1)
lucid_chrony: ignored (reached end-of-life)
precise_chrony: ignored (reached end-of-life)
precise/esm_chrony: DNE (precise was needed)
trusty_chrony: released (1.29-1ubuntu0.1)
trusty/esm_chrony: released (1.29-1ubuntu0.1)
utopic_chrony: ignored (reached end-of-life)
vivid_chrony: ignored (reached end-of-life)
vivid/stable-phone-overlay_chrony: DNE
vivid/ubuntu-core_chrony: DNE
wily_chrony: ignored (reached end-of-life)
xenial_chrony: not-affected (2.1.1-1)
yakkety_chrony: ignored (reached end-of-life)
zesty_chrony: ignored (reached end-of-life)
artful_chrony: not-affected (3.1-5)
bionic_chrony: not-affected (3.2-4ubuntu1)
cosmic_chrony: not-affected (3.2-4ubuntu1)
devel_chrony: not-affected (3.2-4ubuntu1)