CVE-2014-0021: chrony traffic amplification in cmdmon protocol

["Vincent Danen" <vdanen () redhat com>]

With the news about the traffic amplification issue in ntpd, one of our developers looked at chronyd and it suffers 
from the same flaw.

We've filed a bug [1] and it's also been brought up upstream [2].  There is currently no fix, but as the ntpd issue has 
been gaining some interest, I'm bringing this up here now for other who may ship chrony.  We assigned it CVE-2014-0021.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1054790
[2] http://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-dev/2014/01/msg00001.html

Thanks.

-- 
Vincent Danen / Red Hat Security Response Team

Attachment: signature.asc
Description: OpenPGP digital signature