PT-2013-1680 · Chrony+1 · Chrony+1

Florian Weimer · Published 2013-11-05 · Updated 2024-06-15 · CVE-2012-4503

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Chrony versions prior to 1.29

Description The issue allows remote attackers to obtain potentially sensitive information from stack memory. This can occur through two vectors: (1) an invalid subnet in a RPY SUBNETS ACCESSED command to the handle subnets accessed function or (2) a RPY CLIENT ACCESSES command to the handle client accesses function when client logging is disabled, resulting in uninitialized data being included in a reply.

Recommendations For Chrony versions prior to 1.29, update to version 1.29 or later to resolve the issue. As a temporary workaround, consider disabling client logging to minimize the risk of exploitation. Restrict access to the handle subnets accessed and handle client accesses functions until a patch is available. Avoid using the RPY SUBNETS ACCESSED and RPY CLIENT ACCESSES commands in the affected API endpoint until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2014-1267

CVE-2012-4503

DSA-2760-1

OPENSUSE-SU-2024:10345-1

Affected Products

Alt Linux

Chrony

References · 24

• 🔥 http://git.tuxfamily.org/chrony/chrony.git/?p=chrony/chrony.git;a=commitdiff;h=c6fdeeb6bb0b17dc28c19ae492c4a1c498e54ea3 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4502 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-4503 · Security Note
• https://ubuntu.com/security/CVE-2012-4503 · Vendor Advisory
• http://debian.org/security/2013/dsa-2760 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-4503 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-4503 · Vendor Advisory
• http://seclists.org/oss-sec/2013/q3/332 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4503 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-1267 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4503 · Security Note
• https://osv.dev/vulnerability/CVE-2012-4503 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-4503 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10345-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0021 · Security Note