Bug 500258 – <net-misc/chrony-1.29.1: chronyc Protocol Response Amplification Denial of Service Vulnerability (CVE-2014-0021)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2014-02-04 10:38:00 UTC]

From ${URL} :

Description

A vulnerability has been reported in Chrony, which can be exploited by malicious people to cause a DoS 
(Denial of Service).

The vulnerability is caused due to an error when processing certain command packets and can be exploited 
to amplify the size of responses and subsequently cause a DoS condition by sending specially crafted 
requests.

The vulnerability is reported in versions prior to 1.29.1.


Solution:
Update to version 1.29.1.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://chrony.tuxfamily.org/News.html


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Jeroen Roovers (RETIRED) 2014-02-04 15:00:43 UTC]

Arch teams, please test and mark stable:
=net-misc/chrony-1.29.1
Targeted stable KEYWORDS : amd64 hppa ppc sparc x86

[Comment 2 Jeroen Roovers (RETIRED) 2014-02-05 11:06:09 UTC]

Stable for HPPA.

[Comment 3 Agostino Sarubbo 2014-02-06 06:05:20 UTC]

amd64 stable

[Comment 4 Agostino Sarubbo 2014-02-06 06:05:39 UTC]

x86 stable

[Comment 5 Agostino Sarubbo 2014-02-09 08:19:11 UTC]

ppc stable

[Comment 6 Agostino Sarubbo 2014-02-09 08:29:26 UTC]

sparc stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 7 Chris Reffett (RETIRED) 2014-02-09 14:34:31 UTC]

GLSA vote: no.

[Comment 8 Sergey Popov (RETIRED) 2014-02-26 14:50:21 UTC]

GLSA vote: no

Cleanup was done by Jeroen Roovers.

Closing as noglsa.