CVE-2015-1853 : chrony before 1.31.1 does not properly protect state variables in authenticated

chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.

Published 2019-12-09 19:15:14

Updated 2023-02-13 00:47:23

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2015-1853

Tuxfamily » Chrony
Versions before (<) 1.31.1
cpe:2.3:a:tuxfamily:chrony:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-1853

EPSS FAQ

0.92%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 75 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-1853

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:N/A:P	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2015-1853

https://security.gentoo.org/glsa/201507-01

chrony: Multiple vulnerabilities (GLSA 201507-01) — Gentoo security
Third Party Advisory

CVEs referencing this url
http://chrony.tuxfamily.org/News.html

chrony – News
Release Notes;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2015-1853

Products affected by CVE-2015-1853

Exploit prediction scoring system (EPSS) score for CVE-2015-1853

CVSS scores for CVE-2015-1853

References for CVE-2015-1853