NVD

Id
45884  
Name
CVE-2012-4502  
Description
Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to the PKL_CommandLength function or crafted (3) RPY_SUBNETS_ACCESSED, (4) RPY_CLIENT_ACCESSES, (5) RPY_CLIENT_ACCESSES_BY_INDEX, or (6) RPY_MANUAL_LIST command reply to the PKL_ReplyLength function, which triggers an out-of-bounds read or buffer overflow. NOTE: versions 1.27 and 1.28 do not require authentication to exploit.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2013-11-05  
Modified Date
2013-11-06  
Seq
2012-4502  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
230377 45884 CVE-2012-4502 http://git.tuxfamily.org/chrony/chrony.git/?p=chrony/chrony.git;a=commitdiff;h=7712455d9aa33d0db0945effaa07e900b85987b1  View
230378 45884 CVE-2012-4502 [chrony-announce] 20130808 chrony-1.29 released (security)  View
230379 45884 CVE-2012-4502 [oss-security] 20130809 [Not a CVE request, just notification] CVE-2012-4502, CVE-2012-4503 -- Two security flaws fixed in Chrony v1.29  View
230380 45884 CVE-2012-4502 DSA-2760  View
230381 45884 CVE-2012-4502 https://bugzilla.redhat.com/show_bug.cgi?id=846392  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
30364 JVNDB-2012-006072 chrony の pktlength.c における整数オーバーフローの脆弱性 chrony の pktlength.c には、整数オーバーフローの脆弱性が存在します。 CVE-2012-4502 57740 CVE-2012-4502 45884 5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-006072.html 2012-08-07 2013-11-07 View