[ GLSA 200904-10 ] Avahi: Denial of Service



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200904-10
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Avahi: Denial of Service
Date: April 08, 2009
Bugs: #260971
ID: 200904-10

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

An error in Avahi might lead to a Denial of Service via network and CPU
consumption.

Background
==========

Avahi is a system that facilitates service discovery on a local
network.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-dns/avahi < 0.6.24-r2 >= 0.6.24-r2

Description
===========

Rob Leslie reported that the
originates_from_local_legacy_unicast_socket() function in
avahi-core/server.c does not account for the network byte order of a
port number when processing incoming multicast packets, leading to a
multicast packet storm.

Impact
======

A remote attacker could send specially crafted legacy unicast mDNS
query packets to the Avahi daemon, resulting in a Denial of Service due
to network bandwidth and CPU consumption.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Avahi users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-dns/avahi-0.6.24-r2"

References
==========

[ 1 ] CVE-2009-0758
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0758

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200904-10.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@xxxxxxxxxx or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2009 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Attachment: signature.asc
Description: This is a digitally signed message part.



Relevant Pages

  • [Full-disclosure] [ GLSA 200904-10 ] Avahi: Denial of Service
    ... An error in Avahi might lead to a Denial of Service via network and CPU ... Security is a primary focus of Gentoo Linux and ensuring the ...
    (Full-Disclosure)
  • Re: Vista (running ubuntu)
    ... you have more than one ubuntu machine in your network ... ... and running try pinging.local in your network ... ... this works from any avahi capable system to another. ... beyond that, if you use rhythmbox, you might notice it is able to play ...
    (Ubuntu)
  • Re: Vista (running ubuntu)
    ... you have more than one ubuntu machine in your network ... ... and running try pinging.local in your network ... ... I have two Ubuntu systems in my home connected to a wireless ... avahi jumps in and gives me a zeroconf ...
    (Ubuntu)
  • Re: Iptables port 5353 -
    ... You benefit depends on your network infrastructure. ... DNS server then there is no benefit. ... avahi along with nss-mdns give you dynamic IP resolving. ... You also get a service discovery feature. ...
    (Fedora)
  • [Full-disclosure] [ GLSA 200901-11 ] Avahi: Denial of Service
    ... Bugs: #250913 ... A Denial of Service vulnerability has been discovered in Avahi. ... Avahi is a system that facilitates service discovery on a local ... Security is a primary focus of Gentoo Linux and ensuring the ...
    (Full-Disclosure)