Test ID:	1.3.6.1.4.1.25623.1.0.703222
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-3222-1)
Summary:	The remote host is missing an update for the Debian 'chrony' package(s) announced via the DSA-3222-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'chrony' package(s) announced via the DSA-3222-1 advisory. Vulnerability Insight: Miroslav Lichvar of Red Hat discovered multiple vulnerabilities in chrony, an alternative NTP client and server: CVE-2015-1821 Using particular address/subnet pairs when configuring access control would cause an invalid memory write. This could allow attackers to cause a denial of service (crash) or execute arbitrary code. CVE-2015-1822 When allocating memory to save unacknowledged replies to authenticated command requests, a pointer would be left uninitialized, which could trigger an invalid memory write. This could allow attackers to cause a denial of service (crash) or execute arbitrary code. CVE-2015-1853 When peering with other NTP hosts using authenticated symmetric association, the internal state variables would be updated before the MAC of the NTP messages was validated. This could allow a remote attacker to cause a denial of service by impeding synchronization between NTP peers. For the stable distribution (wheezy), these problems have been fixed in version 1.24-3.1+deb7u3. For the unstable distribution (sid), these problems have been fixed in version 1.30-2. We recommend that you upgrade your chrony packages. Affected Software/OS: 'chrony' package(s) on Debian 7. Solution: Please install the updated package(s). CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-1821 73955 http://www.securityfocus.com/bid/73955 DSA-3222 http://www.debian.org/security/2015/dsa-3222 GLSA-201507-01 https://security.gentoo.org/glsa/201507-01 [chrony-announce] 20150407 chrony-1.31.1 released (security) http://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2015/04/msg00002.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html Common Vulnerability Exposure (CVE) ID: CVE-2015-1822 73956 http://www.securityfocus.com/bid/73956 Common Vulnerability Exposure (CVE) ID: CVE-2015-1853 http://chrony.tuxfamily.org/News.html
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.