Unscored severity · published Feb 8, 2010
CVE-2010-0293
The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to…
–
CVSS
2.7%
EPSS
No
On KEV
Description
The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of service (memory consumption) via spoofed (1) NTP or (2) cmdmon packets.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chrony · Tuxfamily
through 1.23-pre1; 1.18; 1.19; 1.19-1; 1.19.99.1; 1.19.99.2; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-0293
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-0293
Vendor Advisory
http://chrony.tuxfamily.org/News.html
git.tuxfamily.org
http://git.tuxfamily.org/chrony/chrony.git/?p=gitroot/chrony/chrony.git%3Ba=commit%3Bh=2f63cf448560fdb96b80d8488aae6a15b802a753
Vendor Advisory
http://secunia.com/advisories/38428
Vendor Advisory
http://secunia.com/advisories/38480
www.debian.org
http://www.debian.org/security/2010/dsa-1992
www.securityfocus.com
http://www.securityfocus.com/bid/38106
More from Chrony
8.1
CVE-2016-1567
chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct…
6.5
CVE-2015-1853
chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a…
6.0
CVE-2020-14367
A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder
–
CVE-2015-1822
chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial…
–
CVE-2015-1821
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring…