chrony - Security Update (CVE-2016-1567)
Summary
DLA-742-1: chrony - security update. Affects chrony versions < 1.24-3.1+deb7u4. Fixed in 1.24-3.1+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
chrony is a versatile implementation of the Network Time Protocol (NTP) that synchronizes the system clock with remote NTP servers. It is commonly used on Debian 7 systems. This vulnerability (CVE-2016-1567) affects chrony versions prior to 1.24-3.1+deb7u4.
Vulnerability Detail
CVE-2016-1567 is a security vulnerability in chrony that allows remote attackers to cause a denial of service (DoS) or possibly execute arbitrary code via a crafted NTP packet. This vulnerability can be exploited by sending a specially crafted NTP packet to the chrony server, leading to a crash or potential code execution.
How To Fix
Minimum fixed version
1.24-3.1+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade chronyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to protect the system.
Conclusion
The security update for chrony addresses a vulnerability (CVE-2016-1567) that could allow remote attackers to cause a denial of service or potentially execute arbitrary code. It is crucial to upgrade chrony to version 1.24-3.1+deb7u4 or later to protect the system. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for chrony →
FAQ
chrony is an implementation of the Network Time Protocol (NTP) used to synchronize the system clock with remote NTP servers.
This vulnerability allows remote attackers to cause a denial of service (DoS) or potentially execute arbitrary code on the affected system.
To fix this vulnerability, upgrade chrony to version 1.24-3.1+deb7u4 or later by using the package manager on the Debian 7 system.
No, there is no known workaround for this vulnerability. Applying the security update is the recommended solution.
You can find more information about this vulnerability in the Debian Security Advisory DLA-742-1.
Related vulnerabilities
Recent vulnerabilities recorded for chrony.
