CVE-2012-4503

Published: 05/11/2013 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

cmdmon.c in Chrony prior to 1.29 allows remote malicious users to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the handle_subnets_accessed function or (2) a RPY_CLIENT_ACCESSES command to the handle_client_accesses function when client logging is disabled, which causes uninitialized data to be included in a reply.

Vulnerable Product	Search on Vulmon	Subscribe to Product
tuxfamily chrony 1.24
tuxfamily chrony 1.21
tuxfamily chrony 1.19
tuxfamily chrony 1.23
tuxfamily chrony 1.25
tuxfamily chrony 1.1
tuxfamily chrony 1.27
tuxfamily chrony 1.20
tuxfamily chrony
tuxfamily chrony 1.19.99.3
tuxfamily chrony 1.23.1
tuxfamily chrony 1.19.99.2
tuxfamily chrony 1.0
tuxfamily chrony 1.28
tuxfamily chrony 1.18
tuxfamily chrony 1.26
tuxfamily chrony 1.19.99.1

Debian Bug report logs - #719203 chrony: CVE-2012-4502 and CVE-2012-4503 Package: chrony; Maintainer for chrony is Vincent Blut <vincentdebian@freefr>; Source for chrony is src:chrony (PTS, buildd, popcon) Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 9 Aug 2013 08:51:02 UTC Severity: grave Tag ...

Florian Weimer discovered two security problems in the Chrony time synchronisation software (buffer overflows and use of uninitialised data in command replies) For the oldstable distribution (squeeze), these problems will be fixed soon in 124-3+squeeze1 (due to a technical restriction in the archive processing scripts the two updates cannot be re ...

cmdmonc in Chrony before 129 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the handle_subnets_accessed function or (2) a RPY_CLIENT_ACCESSES command to the handle_client_accesses function when client logging is disabled, which ...

CWE-200 http://seclists.org/oss-sec/2013/q3/332 http://www.debian.org/security/2013/dsa-2760 https://bugzilla.redhat.com/show_bug.cgi?id=846392 http://permalink.gmane.org/gmane.comp.time.chrony.announce/15 http://git.tuxfamily.org/chrony/chrony.git/?p=chrony/chrony.git%3Ba=commitdiff%3Bh=c6fdeeb6bb0b17dc28c19ae492c4a1c498e54ea3 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=719203 https://access.redhat.com/security/cve/cve-2012-4503 https://www.debian.org/security/./dsa-2760

CVE-2012-4503

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect