CVE-2015-1853 — MEDIUM (6.5)

Q: How severe is CVE-2015-1853?

CVE-2015-1853 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2015-1853?

Check the references section above for vendor advisories and patch information. Affected products include: Tuxfamily Chrony.

Vulnerability Description

chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Tuxfamily	Chrony	< 1.31.1

References

http://chrony.tuxfamily.org/News.htmlRelease NotesVendor Advisory
https://security.gentoo.org/glsa/201507-01Third Party Advisory
http://chrony.tuxfamily.org/News.htmlRelease NotesVendor Advisory
https://security.gentoo.org/glsa/201507-01Third Party Advisory

FAQ

What is CVE-2015-1853?

CVE-2015-1853 is a vulnerability with a CVSS score of 6.5 (MEDIUM). chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (in...

How severe is CVE-2015-1853?

CVE-2015-1853 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2015-1853?

Check the references section above for vendor advisories and patch information. Affected products include: Tuxfamily Chrony.