CVE-2016-1567 Auth bypass in n/a

What is CVE-2016-1567?

CVE-2016-1567 is a high-severity authentication bypass vulnerability in n/a, published on 26 Jan 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."

Weakness: CWE-254

Which versions are affected by CVE-2016-1567?

It affects 1 product.

Products include Tuxfamily Chrony.

How do I fix CVE-2016-1567?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2016-1567 being exploited?

There is no known exploitation of CVE-2016-1567 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2015-1853 Denial of service in chrony Medium 6.5
• CVE-2012-4502 Integer overflow in n/a Medium 5.0
• CVE-2012-4503 Information disclosure in n/a Medium 5.0
• CVE-2010-0292 Denial of service in n/a Medium 5.0
• CVE-2010-0293 Denial of service in n/a Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2016-1567, DLA-414-1, DLA-742-1, GHSA-vwxj-hm98-qj7v, MGASA-2016-0038, UBUNTU-CVE-2016-1567.