According to the version of the chrony package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in chrony versions before 3.5.1 when     creating the PID file under the /var/run/chrony folder.
    The file is created during chronyd startup while still     running as the root user, and when it's opened for     writing, chronyd does not check for an existing     symbolic link with the same file name. This flaw allows     an attacker with privileged access to create a symlink     with the default PID file name pointing to any     destination file in the system, resulting in data loss     and a denial of service due to the path     traversal.(CVE-2020-14367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1431 advisory.

  - A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony     folder. The file is created during chronyd startup while still running as the root user, and when it's     opened for writing, chronyd does not check for an existing symbolic link with the same file name. This     flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing     to any destination file in the system, resulting in data loss and a denial of service due to the path     traversal. (CVE-2020-14367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Miroslav Lichvar reports :

chrony-3.5.1 [...] fixes a security issue in writing of the pidfile.

When chronyd is configured to save the pidfile in a directory where the chrony user has write permissions (e.g. /var/run/chrony - the default since chrony-3.4), an attacker that compromised the chrony user account could create a symbolic link at the location of the pidfile to make chronyd starting with root privileges follow the symlink and write its process ID to a file for which the chrony user doesn't have write permissions, causing a denial of service, or data loss.

This issue was reported by Matthias Gerstner of SUSE.

It was discovered that Chrony incorrectly handled certain symbolic links. An attacker could possibly use this issue to cause a denial of service or expose sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the chrony package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in chrony versions before 3.5.1 when     creating the PID file under the /var/run/chrony folder.
    The file is created during chronyd startup while still     running as the root user, and when it's opened for     writing, chronyd does not check for an existing     symbolic link with the same file name. This flaw allows     an attacker with privileged access to create a symlink     with the default PID file name pointing to any     destination file in the system, resulting in data loss     and a denial of service due to the path     traversal.(CVE-2020-14367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202008-23 (chrony: Symlink vulnerability)

    It was found that chrony did not check whether its PID file was a       symlink.
  Impact :

    A local attacker could perform symlink attack(s) to overwrite arbitrary       files with root privileges.
  Workaround :

    There is no known workaround at this time.

Security fix for CVE-2020-14367

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1575 advisory.

  - A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony     folder. The file is created during chronyd startup while still running as the root user, and when it's     opened for writing, chronyd does not check for an existing symbolic link with the same file name. This     flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing     to any destination file in the system, resulting in data loss and a denial of service due to the path     traversal. (CVE-2020-14367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the chrony packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in chrony versions before 3.5.1 when     creating the PID file under the /var/run/chrony folder.
    The file is created during chronyd startup while still     running as the root user, and when it's opened for     writing, chronyd does not check for an existing     symbolic link with the same file name. This flaw allows     an attacker with privileged access to create a symlink     with the default PID file name pointing to any     destination file in the system, resulting in data loss     and a denial of service due to the path     traversal.(CVE-2020-14367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the chrony package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in chrony versions before 3.5.1 when     creating the PID file under the /var/run/chrony folder.
    The file is created during chronyd startup while still     running as the root user, and when it's opened for     writing, chronyd does not check for an existing     symbolic link with the same file name. This flaw allows     an attacker with privileged access to create a symlink     with the default PID file name pointing to any     destination file in the system, resulting in data loss     and a denial of service due to the path     traversal.(CVE-2020-14367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the chrony package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in chrony when creating the PID file     under the /var/run/chrony folder. The file is created     during chronyd startup while still running as the root     user, and when it's opened for writing, chronyd does     not check for an existing symbolic link with the same     file name. This flaw allows an attacker with privileged     access to create a symlink with the default PID file     name pointing to any destination file in the system,     resulting in data loss and a denial of service due to     the path traversal.(CVE-2020-14367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
143395	EulerOS 2.0 SP9 : chrony (EulerOS-SA-2020-2495)	Nessus	Huawei Local Security Checks	12/1/2020	4/19/2021	medium
143393	EulerOS 2.0 SP9 : chrony (EulerOS-SA-2020-2482)	Nessus	Huawei Local Security Checks	12/1/2020	1/6/2021	medium
140206	Amazon Linux AMI : chrony (ALAS-2020-1431)	Nessus	Amazon Linux Local Security Checks	9/4/2020	9/4/2020	medium
139763	FreeBSD : chrony <= 3.5.1 data corruption through symlink vulnerability writing the pidfile (719f06af-e45e-11ea-95a1-c3b8167b8026)	Nessus	FreeBSD Local Security Checks	8/24/2020	9/8/2020	medium
140029	Ubuntu 18.04 LTS / 20.04 : Chrony vulnerability (USN-4475-1)	Nessus	Ubuntu Local Security Checks	8/28/2020	9/17/2020	medium
147541	EulerOS Virtualization 3.0.2.6 : chrony (EulerOS-SA-2021-1429)	Nessus	Huawei Local Security Checks	3/10/2021	3/16/2021	medium
140071	GLSA-202008-23 : chrony: Symlink vulnerability	Nessus	Gentoo Local Security Checks	8/31/2020	9/8/2020	medium
146179	EulerOS 2.0 SP5 : chrony (EulerOS-SA-2021-1182)	Nessus	Huawei Local Security Checks	2/4/2021	2/8/2021	medium
144118	EulerOS 2.0 SP8 : chrony (EulerOS-SA-2020-2509)	Nessus	Huawei Local Security Checks	12/14/2020	1/6/2021	medium
139761	Fedora 32 : chrony (2020-7aa962c55e)	Nessus	Fedora Local Security Checks	8/24/2020	9/8/2020	medium
144806	Amazon Linux 2 : chrony (ALAS-2021-1575)	Nessus	Amazon Linux Local Security Checks	1/8/2021	1/8/2021	medium
147595	EulerOS Virtualization 3.0.6.6 : chrony (EulerOS-SA-2021-1462)	Nessus	Huawei Local Security Checks	3/10/2021	3/16/2021	medium
147067	EulerOS Virtualization for ARM 64 3.0.6.0 : chrony (EulerOS-SA-2021-1581)	Nessus	Huawei Local Security Checks	3/4/2021	3/8/2021	medium
151328	EulerOS Virtualization for ARM 64 3.0.2.0 : chrony (EulerOS-SA-2021-2110)	Nessus	Huawei Local Security Checks	7/2/2021	7/6/2021	medium

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium