Security features bypass in chrony (Alpine package)

1) Security features bypass

EUVDB-ID: #VU33078

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-1567

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."

Mitigation

Install update from vendor's website.

Vulnerable software versions

curl (Alpine package): 7.19.6-r0 - 7.49.1-r4

chrony (Alpine package): 2.2-r0

CPE2.3

• cpe:2.3:o:alpine:curl_alpine_package:7.39.0-r0:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:curl_alpine_package:7.49.1-r0:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:curl_alpine_package:7.49.1-r1:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:chrony_alpine_package:2.2-r0:*:*:*:*:alpine_linux:*:

External links

http://git.alpinelinux.org/aports/commit/?id=53a3e26e9d0596af548cd03aec543a4190b0e4c1
http://git.alpinelinux.org/aports/commit/?id=d5c5821ebb752ba8df396578e35af5c594cb5b42

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.