Input validation error in Debian Linux and Fedora - CVE-2014-0021
Published: November 15, 2019 / Updated: August 8, 2020
Vulnerability identifier: #VU35066
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-0021
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Chrony before 1.29.1 has traffic amplification in cmdmon protocol
Affected software
Debian Linux
Fedora
Amazon Linux AMI
chrony
Fedora
Amazon Linux AMI
chrony
How to mitigate CVE-2014-0021
Install update from vendor's website.
chrony - addressed in versions 1.30-1.el5, 1.30-1.el6
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127837.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128753.html
- http://www.openwall.com/lists/oss-security/2014/01/17/9
- http://www.openwall.com/lists/oss-security/2014/01/18/1
- http://www.openwall.com/lists/oss-security/2014/01/18/2
- http://www.openwall.com/lists/oss-security/2014/01/18/3
- http://www.openwall.com/lists/oss-security/2014/01/19/1
- http://www.securityfocus.com/bid/65035
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0021
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90925
- https://security-tracker.debian.org/tracker/CVE-2014-0021