Candidate: CVE-2015-1853
PublicDate: 2019-12-09 19:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1853
 http://www.openwall.com/lists/oss-security/2015/04/07/10
 http://chrony.tuxfamily.org/News.html
Description:
 chrony before 1.31.1 does not properly protect state variables in
 authenticated symmetric NTP associations, which allows remote attackers
 with knowledge of NTP peering to cause a denial of service (inability to
 synchronize) via random timestamps in crafted NTP data packets.
Ubuntu-Description:
 Miroslav Lichvár discovered a head-based buffer overflow in chrony. A remote
 attacker could use this vulnerability to cause a denial of service (crash) or
 execute arbitrary code.
Notes:
Bugs:
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782160
Priority: medium
Discovered-by: Miroslav Lichvár
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H [6.5 MEDIUM]

Patches_chrony:
upstream_chrony: released (1.31.1)
lucid_chrony: ignored (reached end-of-life)
precise_chrony: ignored (reached end-of-life)
precise/esm_chrony: DNE (precise was needed)
trusty_chrony: released (1.29-1ubuntu0.1)
trusty/esm_chrony: not-affected (trusty was released [1.29-1ubuntu0.1])
utopic_chrony: ignored (reached end-of-life)
vivid_chrony: ignored (reached end-of-life)
vivid/stable-phone-overlay_chrony: DNE
vivid/ubuntu-core_chrony: DNE
wily_chrony: ignored (reached end-of-life)
xenial_chrony: not-affected (2.1.1-1)
yakkety_chrony: ignored (reached end-of-life)
zesty_chrony: ignored (reached end-of-life)
artful_chrony: not-affected (3.1-5)
bionic_chrony: not-affected (3.2-4ubuntu1)
cosmic_chrony: not-affected (3.2-4ubuntu1)
devel_chrony: not-affected (3.2-4ubuntu1)