Detections
Analytics
MiracleLinux 7 : chrony-2.1.1-1.0.1.el7.AXS7 (AXSA:2015-927:01)
medium Nessus Plugin ID 289344
Synopsis
The remote MiracleLinux host is missing one or more security updates.Description
The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2015-927:01 advisory.A client/server for the Network Time Protocol, this program keeps your computer's clock accurate. It was specially designed to support systems with intermittent internet connections, but it also works well in permanently connected environments. It can use also hardware reference clocks, system real-time clock or manual input as time references.
Security issues fixed with this release:
CVE-2015-1821 Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the subnet remainder.
CVE-2015-1822 chrony before 1.31.1 does not initialize the last next pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.
CVE-2015-1853
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
Fixed bugs:
* Updated to NTP version 4 (RFC 5905)
* Added pool directive to specify pool of NTP servers
* Added leapsecmode directive to select how to correct clock for leap second
* Added smoothtime directive to smooth served time and enable leap smear
* Added asynchronous name resolving with POSIX threads
* Ready for year 2036 (next NTP era)
* Improved clock control
* Networking code reworked to open separate client sockets for each NTP server Fixed bugs:
* The chronyd service previously assumed that network interfaces specified with the bindaddress directive were ready when the service was started. This could cause chronyd to fail to bind an NTP server socket to the interface if the interface was not ready. With this update, chronyd uses the IP_FREEBIND socket option, enabling it to bind to an interface later, not only when the service starts.
Enhancements:
* The chronyd service now supports four modes of handling leap seconds, configured using the leapsecmode option. The clock can be either stepped by the kernel (the default system mode), stepped by chronyd (step mode), slowly adjusted by slewing (slew mode), or the leap second can be ignored and corrected later in normal operation (ignore mode). If you select slewing, the correction will always start at 00:00:00 UTC and will be applied at a rate specified in the maxslewrate option.
Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected chrony package.See Also
Plugin Details
Severity: Medium
ID: 289344
File Name: miracle_linux_AXSA-2015-927.nasl
Version: 1.1
Type: local
Published: 1/16/2026
Updated: 1/16/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
Vendor
Vendor Severity: Moderate
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 4.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2015-1822
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2015-1853
Vulnerability Information
CPE: p-cpe:/a:miracle:linux:chrony, cpe:/o:miracle:linux:7
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/MiracleLinux/release, Host/MiracleLinux/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 12/11/2015
Vulnerability Publication Date: 4/7/2015