CVE-2012-4502: Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of...

Security readout for executives and security teams

This issue affects Chrony before 1.29 and can let a remote attacker crash the service with specially crafted Chrony command traffic. The known impact is denial of service, not confirmed data theft or code execution. Chrony 1.27 and 1.28 are higher concern because the source bundle says authentication is not required to exploit them. Exposure is likely limited to systems running Chrony before 1.29, especially 1.27 or 1.28, where authentication is reportedly not required. Risk is higher where Chrony command traffic can be reached from untrusted networks or where time synchronization availability is operationally important. Handle as a targeted availability risk. It is old and not listed as actively exploited in the supplied evidence, but exposed vulnerable Chrony services could be crashed remotely and disrupt time-dependent operations. Mitigation focus: Upgrade Chrony to 1.29 or a vendor-supported fixed package.; Prioritize Chrony 1.27 and 1.28 systems due to unauthenticated exploitability.; Restrict Chrony command access to trusted hosts and management networks..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.