Chrony 1.27 is now available. It includes the following improvements:
This is a production release.
Download the tarball here.
Chrony 1.26 is now available. It includes the following improvements:
This is a production release.
Download the tarball here.
Chrony 1.25 is now available. It includes the following improvements and new features:
This is a production release.
Download the tarball here.
Several vulnerabilities have been discovered in chronyd. These bugs can be exploited for a remote denial of service. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2010-0292
chronyd replies to all cmdmon packets from unauthorized hosts with
NOHOSTACCESS message. This can be used to create a loop between two chrony
daemons which don't allow cmdmon access from each other by sending a packet
with spoofed source address and port. This will cause high CPU, network and
syslog usage.
FIX: Don't reply to invalid cmdmon packets
CVE-2010-0293
The client logging facility doesn't limit memory which is used to keep
informations about clients. If chronyd is configured to allow access
from a large IP address range, an attacker can cause chronyd to
allocate large amount of memory by sending NTP or cmdmon packets with
spoofed source addresses. By default only 127.0.0.1 is allowed.
FIX: Limit client log memory size
CVE-2010-0294
There are several ways that an attacker can make chronyd log messages and
possibly fill up disk space. The rate for these messages should be limited.
FIX: Limit rate of syslog messages
These bugs have been fixed in the new Chrony 1.24 release and in Chrony 1.23.1, both available for download at the download area. Patches are here, here, and here.
We recommend that you upgrade your Chrony package to version 1.24. If you cannot upgrade because you need compatibility with the old cmdmon protocol upgrade to 1.23.1. Upgrade via your distribution's repositories if possible: they should have patched versions available shortly.
Chrony 1.24 is now available. It includes the following improvements and new features:
This is a production release.
Download the tarball here.