Candidate: CVE-2016-1567
PublicDate: 2016-01-26 19:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1567
 http://www.talosintel.com/reports/TALOS-2016-0071/
 http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175969.html
 http://chrony.tuxfamily.org/news.html#_20_jan_2016_chrony_2_2_1_and_chrony_1_31_2_released
Description:
 chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations
 of symmetric keys when authenticating packets, which might allow remote
 attackers to conduct impersonation attacks via an arbitrary trusted key,
 aka a "skeleton key."
Ubuntu-Description:
 Matt Street discovered that chrony doesn't verify peer associations of
 symmetric keys. A remote attacker could use this vulnerability impersonate
 another user.
Notes:
Bugs:
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=812923
Priority: low
Discovered-by: Matt Street
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H [8.1 HIGH]

Patches_chrony:
 upstream: https://git.tuxfamily.org/chrony/chrony.git/commit/?id=a78bf9725a7b481
upstream_chrony: released (2.2.1, 1.31.2)
precise_chrony: ignored (reached end-of-life)
precise/esm_chrony: DNE (precise was needed)
trusty_chrony: released (1.29-1ubuntu0.1)
trusty/esm_chrony: released (1.29-1ubuntu0.1)
vivid_chrony: ignored (reached end-of-life)
vivid/stable-phone-overlay_chrony: DNE
vivid/ubuntu-core_chrony: DNE
wily_chrony: ignored (reached end-of-life)
xenial_chrony: released (2.1.1-1ubuntu0.1)
yakkety_chrony: ignored (reached end-of-life)
zesty_chrony: ignored (reached end-of-life)
artful_chrony: not-affected (3.1-5)
bionic_chrony: not-affected (3.2-4ubuntu1)
cosmic_chrony: not-affected (3.2-4ubuntu1)
devel_chrony: not-affected (3.2-4ubuntu1)