Re: CVE-2014-0021: chrony traffic amplification in cmdmon protocol

[Florian Weimer <fweimer () redhat com>]

On 01/17/2014 11:54 PM, Vincent Danen wrote:
> With the news about the traffic amplification issue in ntpd, one of our developers looked at chronyd and it suffers 
> from the same flaw.
>
> We've filed a bug [1] and it's also been brought up upstream [2].  There is currently no fix, but as the ntpd issue has been 
> gaining some interest, I'm bringing this up here now for other who may ship chrony.  We assigned it CVE-2014-0021.

I noticed this as well when reviewing chrony quite a while ago, but I 
did not press the issue because its restricted to localhost by default 
and the amplification factor is low, especially in packet count terms. 
At the time, I did not consider it comparable to the ntpd issue at all, 
and I still don't.

Comparable levels of amplification are present in TCP itself and many 
other UDP-based protocols.

--
Florian Weimer / Red Hat Product Security Team