Back to Database
Status published
High
CVE-2016-1567
chrony before 1.31.2 and 2.x before 2.2.1 do not verify...
Vulnerability Description
chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-1567
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.talosintel.com/reports/TALOS-2016-0071/
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176559.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175969.html
- http://chrony.tuxfamily.org/news.html#_20_jan_2016_chrony_2_2_1_and_chrony_1_31_2_released
More from tuxfamily
View All →CVE-2015-1821
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated...
Medium
6.5
CVE-2012-4503
cmdmon.c in Chrony before 1.29 allows remote attackers to obtain...
Medium
5
CVE-2012-4502
Multiple integer overflows in pktlength.c in Chrony before 1.29 allow...
Medium
5
CVE-2010-0294
chronyd in Chrony before 1.23.1, and possibly 1.24-pre1, generates a...
Medium
5
CVE-2010-0293
The client logging functionality in chronyd in Chrony before 1.23.1...
Medium
5
Affected Vendor
tuxfamily
View all reports →Affected Software
chrony
Vulnerable Versions:
0, 2.0, 2.1, 2.1.1, 2.2
Timeline
Official Publish:
January 26th, 2016
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.