The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of service (memory consumption) via spoofed (1) NTP or (2) cmdmon packets.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has chrony packages installed that are affected by multiple vulnerabilities:

  - chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when     authenticating packets, which might allow remote attackers to conduct impersonation attacks via an     arbitrary trusted key, aka a skeleton key. (CVE-2016-1567)

  - The read_from_cmd_socket function in cmdmon.c in chronyd in Chrony before 1.23.1, and 1.24-pre1, allows     remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a spoofed cmdmon     packet that triggers a continuous exchange of NOHOSTACCESS messages between two daemons, a related issue     to CVE-2009-3563. (CVE-2010-0292)

  - The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory     used for storage of client information, which allows remote attackers to cause a denial of service (memory     consumption) via spoofed (1) NTP or (2) cmdmon packets. (CVE-2010-0293)

  - chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a syslog message for each unauthorized     cmdmon packet, which allows remote attackers to cause a denial of service (disk consumption) via a large     number of invalid packets. (CVE-2010-0294)

  - Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial     of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to     the PKL_CommandLength function or crafted (3) RPY_SUBNETS_ACCESSED, (4) RPY_CLIENT_ACCESSES, (5)     RPY_CLIENT_ACCESSES_BY_INDEX, or (6) RPY_MANUAL_LIST command reply to the PKL_ReplyLength function, which     triggers an out-of-bounds read or buffer overflow. NOTE: versions 1.27 and 1.28 do not require     authentication to exploit. (CVE-2012-4502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has chrony packages installed that are affected by multiple vulnerabilities:

  - chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when     authenticating packets, which might allow remote attackers to conduct impersonation attacks via an     arbitrary trusted key, aka a skeleton key. (CVE-2016-1567)

  - The read_from_cmd_socket function in cmdmon.c in chronyd in Chrony before 1.23.1, and 1.24-pre1, allows     remote attackers to cause a denial of service (CPU and bandwidth consumption) by sending a spoofed cmdmon     packet that triggers a continuous exchange of NOHOSTACCESS messages between two daemons, a related issue     to CVE-2009-3563. (CVE-2010-0292)

  - The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory     used for storage of client information, which allows remote attackers to cause a denial of service (memory     consumption) via spoofed (1) NTP or (2) cmdmon packets. (CVE-2010-0293)

  - chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a syslog message for each unauthorized     cmdmon packet, which allows remote attackers to cause a denial of service (disk consumption) via a large     number of invalid packets. (CVE-2010-0294)

  - Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial     of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to     the PKL_CommandLength function or crafted (3) RPY_SUBNETS_ACCESSED, (4) RPY_CLIENT_ACCESSES, (5)     RPY_CLIENT_ACCESSES_BY_INDEX, or (6) RPY_MANUAL_LIST command reply to the PKL_ReplyLength function, which     triggers an out-of-bounds read or buffer overflow. NOTE: versions 1.27 and 1.28 do not require     authentication to exploit. (CVE-2012-4502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes several vulnerabilities that can be exploited for a remote denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in chrony, a pair of programs which are used to maintain the accuracy of the system clock on a computer. This issues are similar to the NTP security flaw CVE-2009-3563. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-0292     chronyd replies to all cmdmon packets with NOHOSTACCESS     messages even for unauthorized hosts. An attacker can     abuse this behaviour to force two chronyd instances to     play packet ping-pong by sending such a packet with     spoofed source address and port. This results in high     CPU and network usage and thus denial of service     conditions.

  - CVE-2010-0293     The client logging facility of chronyd doesn't limit     memory that is used to store client information. An     attacker can cause chronyd to allocate large amounts of     memory by sending NTP or cmdmon packets with spoofed     source addresses resulting in memory exhaustion.

  - CVE-2010-0294     chronyd lacks of a rate limit control to the syslog     facility when logging received packets from unauthorized     hosts. This allows an attacker to cause denial of     service conditions via filling up the logs and thus disk     space by repeatedly sending invalid cmdmon packets.

ID	Name	Product	Family	Severity
301211	NewStart CGSL MAIN 6.06 (SP) : chrony Multiple Vulnerabilities (NS-SA-2026-0009)	Nessus	NewStart CGSL Local Security Checks	high
266273	NewStart CGSL MAIN 6.06 : chrony Multiple Vulnerabilities (NS-SA-2025-0212)	Nessus	NewStart CGSL Local Security Checks	high
47261	Fedora 12 : chrony-1.23-8.20081106gitbe42b4.fc12 (2010-1539)	Nessus	Fedora Local Security Checks	medium
47260	Fedora 11 : chrony-1.23-6.20081106gitbe42b4.fc11 (2010-1536)	Nessus	Fedora Local Security Checks	medium
44856	Debian DSA-1992-1 : chrony - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2010-0293

high

Tenable Plugins

high

high

medium

medium

medium