CVE-2016-1567
First published: Tue Jan 26 2016(Updated: )
chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Chrony | <=1.31.1 | |
| Chrony | =2.0 | |
| Chrony | =2.1 | |
| Chrony | =2.1.1 | |
| Chrony | =2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://chrony.tuxfamily.org/news.html#_20_jan_2016_chrony_2_2_1_and_chrony_1_31_2_released
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176559.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175969.html
- http://www.talosintel.com/reports/TALOS-2016-0071/
Frequently Asked Questions
What is the severity of CVE-2016-1567?
CVE-2016-1567 has a medium severity rating due to the potential for impersonation attacks.
How do I fix CVE-2016-1567?
To mitigate CVE-2016-1567, upgrade to Chrony version 1.31.2 or 2.2.1 or later.
Which versions of Chrony are affected by CVE-2016-1567?
Chrony versions prior to 1.31.2 and all 2.x versions before 2.2.1 are affected by CVE-2016-1567.
What kind of attack does CVE-2016-1567 enable?
CVE-2016-1567 allows remote attackers to conduct impersonation attacks using an arbitrary trusted key.
Is CVE-2016-1567 specific to any platform or operating system?
CVE-2016-1567 affects Chrony software regardless of the underlying operating system.
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/author
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/tuxfamily
- canonical/chrony
- version/chrony/1.31.1
- version/chrony/2.0
- version/chrony/2.1
- version/chrony/2.1.1
- version/chrony/2.2