Bug 17605

Summary: chrony new security issue CVE-2016-1567
Product: Mageia Reporter: David Walser <luigiwalser>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: normal    
Priority: Normal CC: davidwhodgins, sysadmin-bugs
Version: 5Keywords: validated_update
Target Milestone: ---   
Hardware: i586   
OS: Linux   
URL: http://lwn.net/Vulnerabilities/673463/
Whiteboard: has_procedure MGA5-32-OK advisory
Source RPM: chrony-1.31.1-1.mga5.src.rpm CVE:
Status comment:

Description David Walser 2016-01-25 02:04:03 CET 
Upstream has released version 1.31.2 on January 20, fixing a security issue:
http://chrony.tuxfamily.org/news.html#_20_jan_2016_chrony_2_2_1_and_chrony_1_31_2_released

Updated packages uploaded for Mageia 5 and Cauldron.

Advisory:
========================

Updated chrony package fixes security vulnerability:

In chrony before 1.31.2, when used with symmetric key encryption, the client
would accept packets encrypted with keys for any configured server, allowing
a server to impersonate other servers to clients, thus performing a man-in-
the-middle attack (CVE-2016-1567).

References:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1567
http://chrony.tuxfamily.org/news.html#_20_jan_2016_chrony_2_2_1_and_chrony_1_31_2_released
http://www.talosintel.com/reports/TALOS-2016-0071/
========================

Updated packages in core/updates_testing:
========================
chrony-1.31.2-1.mga5

from chrony-1.31.2-1.mga5.src.rpm

Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2016-01-25 16:48:32 CET 
Fedora has issued an advisory for this on January 23:
https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175969.html

Advisory:
========================

Updated chrony package fixes security vulnerability:

In chrony before 1.31.2, when used with symmetric key encryption, the client
would accept packets encrypted with keys for any configured server, allowing
a server to impersonate other servers to clients, thus performing a man-in-
the-middle attack (CVE-2016-1567).

References:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1567
http://chrony.tuxfamily.org/news.html#_20_jan_2016_chrony_2_2_1_and_chrony_1_31_2_released
http://www.talosintel.com/reports/TALOS-2016-0071/
https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175969.html
David Walser 2016-01-25 20:31:36 CET

URL: (none) => http://lwn.net/Vulnerabilities/673463/

Comment 2 David Walser 2016-01-28 17:17:11 CET 
Working fine on Mageia 5 i586.  You can use "chronyc sources" (as root) to verify that it's synchronized with your configured ntp server(s).

Whiteboard: (none) => has_procedure MGA5-32-OK

Dave Hodgins 2016-01-28 19:55:21 CET

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA5-32-OK => has_procedure MGA5-32-OK advisory
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 3 Mageia Robot 2016-01-29 12:03:44 CET 
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0038.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED