CVEvulnerability
CVE-2010-0293
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-02-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-399
Description
The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of service (memory consumption) via spoofed (1) NTP or (2) cmdmon packets.
Affected configurations
• tuxfamily chrony (<= 1.23-pre1)
• tuxfamily chrony 1.18
• tuxfamily chrony 1.19
• tuxfamily chrony 1.19-1
• tuxfamily chrony 1.19.99.1
• tuxfamily chrony 1.19.99.2
• tuxfamily chrony 1.19.99.3
• tuxfamily chrony 1.20
• tuxfamily chrony 1.21
• tuxfamily chrony 1.21-pre1
• tuxfamily chrony 1.24-pre1
Related
Weakness · not in database (1)
References
- http://chrony.tuxfamily.org/News.html Vendor Advisory
- http://git.tuxfamily.org/chrony/chrony.git/?p=gitroot/chrony/chrony.git%3Ba=commit%3Bh=2f63cf448560fdb96b80d8488aae6a15b802a753 git.tuxfamily.org
- http://secunia.com/advisories/38428 Vendor Advisory
- http://secunia.com/advisories/38480 Vendor Advisory
- http://www.debian.org/security/2010/dsa-1992 www.debian.org
- http://www.securityfocus.com/bid/38106 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=555367 bugzilla.redhat.com
- http://chrony.tuxfamily.org/News.html Vendor Advisory
- http://git.tuxfamily.org/chrony/chrony.git/?p=gitroot/chrony/chrony.git%3Ba=commit%3Bh=2f63cf448560fdb96b80d8488aae6a15b802a753 git.tuxfamily.org
- http://secunia.com/advisories/38428 Vendor Advisory
- http://secunia.com/advisories/38480 Vendor Advisory
- http://www.debian.org/security/2010/dsa-1992 www.debian.org
- http://www.securityfocus.com/bid/38106 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=555367 bugzilla.redhat.com