NVD

Id
45885  
Name
CVE-2012-4503  
Description
cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the handle_subnets_accessed function or (2) a RPY_CLIENT_ACCESSES command to the handle_client_accesses function when client logging is disabled, which causes uninitialized data to be included in a reply.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2013-11-05  
Modified Date
2013-11-06  
Seq
2012-4503  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
230382 45885 CVE-2012-4503 http://git.tuxfamily.org/chrony/chrony.git/?p=chrony/chrony.git;a=commitdiff;h=c6fdeeb6bb0b17dc28c19ae492c4a1c498e54ea3  View
230383 45885 CVE-2012-4503 [chrony-announce] 20130808 chrony-1.29 released (security)  View
230384 45885 CVE-2012-4503 [oss-security] 20130809 [Not a CVE request, just notification] CVE-2012-4502, CVE-2012-4503 -- Two security flaws fixed in Chrony v1.29  View
230385 45885 CVE-2012-4503 DSA-2760  View
230386 45885 CVE-2012-4503 https://bugzilla.redhat.com/show_bug.cgi?id=846392  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
30365 JVNDB-2012-006073 chrony の cmdmon.c におけるスタックメモリから重要な情報を取得される脆弱性 chrony の cmdmon.c には、クライアントロギングが無効な場合、(1) handle_subnets_accessed 関数の RPY_SUBNETS_ACCESSED コマンドの無効なサブネット、または (2) handle_client_accesses 関数の RPY_CLIENT_ACCESSES コマンドに関する処理に不備があり、初期化されていないデータをリプライに含められるため、スタックメモリから重要な情報を取得される脆弱性が存在します。 CVE-2012-4503 57741 CVE-2012-4503 45885 5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-006073.html 2012-08-07 2013-11-07 View