A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it's opened for writing, chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, resulting in data loss and a denial of service due to the path traversal.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - chrony: missing key check allows impersonation between authenticated peers (VU#357792) (CVE-2016-1567)

  - A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony     folder. The file is created during chronyd startup while still running as the root user, and when it's     opened for writing, chronyd does not check for an existing symbolic link with the same file name. This     flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing     to any destination file in the system, resulting in data loss and a denial of service due to the path     traversal. (CVE-2020-14367)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:0845-1 advisory.

  - A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony     folder. The file is created during chronyd startup while still running as the root user, and when it's     opened for writing, chronyd does not check for an existing symbolic link with the same file name. This     flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing     to any destination file in the system, resulting in data loss and a denial of service due to the path     traversal. (CVE-2020-14367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0845-1 advisory.

  - A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony     folder. The file is created during chronyd startup while still running as the root user, and when it's     opened for writing, chronyd does not check for an existing symbolic link with the same file name. This     flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing     to any destination file in the system, resulting in data loss and a denial of service due to the path     traversal. (CVE-2020-14367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:4147-1 advisory.

  - A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony     folder. The file is created during chronyd startup while still running as the root user, and when it's     opened for writing, chronyd does not check for an existing symbolic link with the same file name. This     flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing     to any destination file in the system, resulting in data loss and a denial of service due to the path     traversal. (CVE-2020-14367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the chrony package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in chrony when creating the PID file     under the /var/run/chrony folder. The file is created     during chronyd startup while still running as the root     user, and when it's opened for writing, chronyd does     not check for an existing symbolic link with the same     file name. This flaw allows an attacker with privileged     access to create a symlink with the default PID file     name pointing to any destination file in the system,     resulting in data loss and a denial of service due to     the path traversal.(CVE-2020-14367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the chrony packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in chrony versions before 3.5.1 when     creating the PID file under the /var/run/chrony folder.
    The file is created during chronyd startup while still     running as the root user, and when it's opened for     writing, chronyd does not check for an existing     symbolic link with the same file name. This flaw allows     an attacker with privileged access to create a symlink     with the default PID file name pointing to any     destination file in the system, resulting in data loss     and a denial of service due to the path     traversal.(CVE-2020-14367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the chrony package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in chrony versions before 3.5.1 when     creating the PID file under the /var/run/chrony folder.
    The file is created during chronyd startup while still     running as the root user, and when it's opened for     writing, chronyd does not check for an existing     symbolic link with the same file name. This flaw allows     an attacker with privileged access to create a symlink     with the default PID file name pointing to any     destination file in the system, resulting in data loss     and a denial of service due to the path     traversal.(CVE-2020-14367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the chrony package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in chrony versions before 3.5.1 when     creating the PID file under the /var/run/chrony folder.
    The file is created during chronyd startup while still     running as the root user, and when it's opened for     writing, chronyd does not check for an existing     symbolic link with the same file name. This flaw allows     an attacker with privileged access to create a symlink     with the default PID file name pointing to any     destination file in the system, resulting in data loss     and a denial of service due to the path     traversal.(CVE-2020-14367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the chrony package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in chrony versions before 3.5.1 when     creating the PID file under the /var/run/chrony folder.
    The file is created during chronyd startup while still     running as the root user, and when it's opened for     writing, chronyd does not check for an existing     symbolic link with the same file name. This flaw allows     an attacker with privileged access to create a symlink     with the default PID file name pointing to any     destination file in the system, resulting in data loss     and a denial of service due to the path     traversal.(CVE-2020-14367)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of chrony installed on the remote host is prior to 3.5.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1575 advisory.

    A flaw was found in chrony when creating the PID file under the /var/run/chrony folder. The file is     created during chronyd startup while still running as the root user, and when it's opened for writing,     chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker     with privileged access to create a symlink with the default PID file name pointing to any destination file     in the system, resulting in data loss and a denial of service due to the path traversal. (CVE-2020-14367)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of chrony installed on the remote host is prior to 3.2-1.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1431 advisory.

    A flaw was found in chrony when creating the PID file under the /var/run/chrony folder. The file is     created during chronyd startup while still running as the root user, and when it's opened for writing,     chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker     with privileged access to create a symlink with the default PID file name pointing to any destination file     in the system, resulting in data loss and a denial of service due to the path traversal. (CVE-2020-14367)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202008-23 (chrony: Symlink vulnerability)

    It was found that chrony did not check whether its PID file was a       symlink.
  Impact :

    A local attacker could perform symlink attack(s) to overwrite arbitrary       files with root privileges.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4475-1 advisory.

    It was discovered that Chrony incorrectly handled certain symbolic links. An attacker could possibly use     this issue to cause a denial of service or expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Miroslav Lichvar reports :

chrony-3.5.1 [...] fixes a security issue in writing of the pidfile.

When chronyd is configured to save the pidfile in a directory where the chrony user has write permissions (e.g. /var/run/chrony - the default since chrony-3.4), an attacker that compromised the chrony user account could create a symbolic link at the location of the pidfile to make chronyd starting with root privileges follow the symlink and write its process ID to a file for which the chrony user doesn't have write permissions, causing a denial of service, or data loss.

This issue was reported by Matthias Gerstner of SUSE.

Security fix for CVE-2020-14367

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198983	RHEL 7 : chrony (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196675	RHEL 6 : chrony (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
159043	openSUSE 15 Security Update : chrony (openSUSE-SU-2022:0845-1)	Nessus	SuSE Local Security Checks	medium
158966	SUSE SLED15 / SLES15 Security Update : chrony (SUSE-SU-2022:0845-1)	Nessus	SuSE Local Security Checks	medium
156281	SUSE SLES12 Security Update : chrony (SUSE-SU-2021:4147-1)	Nessus	SuSE Local Security Checks	medium
151328	EulerOS Virtualization for ARM 64 3.0.2.0 : chrony (EulerOS-SA-2021-2110)	Nessus	Huawei Local Security Checks	medium
147595	EulerOS Virtualization 3.0.6.6 : chrony (EulerOS-SA-2021-1462)	Nessus	Huawei Local Security Checks	medium
147541	EulerOS Virtualization 3.0.2.6 : chrony (EulerOS-SA-2021-1429)	Nessus	Huawei Local Security Checks	medium
147067	EulerOS Virtualization for ARM 64 3.0.6.0 : chrony (EulerOS-SA-2021-1581)	Nessus	Huawei Local Security Checks	medium
146179	EulerOS 2.0 SP5 : chrony (EulerOS-SA-2021-1182)	Nessus	Huawei Local Security Checks	medium
144806	Amazon Linux 2 : chrony (ALAS-2021-1575)	Nessus	Amazon Linux Local Security Checks	medium
144118	EulerOS 2.0 SP8 : chrony (EulerOS-SA-2020-2509)	Nessus	Huawei Local Security Checks	medium
143395	EulerOS 2.0 SP9 : chrony (EulerOS-SA-2020-2495)	Nessus	Huawei Local Security Checks	medium
143393	EulerOS 2.0 SP9 : chrony (EulerOS-SA-2020-2482)	Nessus	Huawei Local Security Checks	medium
140206	Amazon Linux AMI : chrony (ALAS-2020-1431)	Nessus	Amazon Linux Local Security Checks	medium
140071	GLSA-202008-23 : chrony: Symlink vulnerability	Nessus	Gentoo Local Security Checks	medium
140029	Ubuntu 18.04 LTS / 20.04 LTS : Chrony vulnerability (USN-4475-1)	Nessus	Ubuntu Local Security Checks	medium
139763	FreeBSD : chrony <= 3.5.1 data corruption through symlink vulnerability writing the pidfile (719f06af-e45e-11ea-95a1-c3b8167b8026)	Nessus	FreeBSD Local Security Checks	medium
139761	Fedora 32 : chrony (2020-7aa962c55e)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2020-14367

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium