Bugtraq mailing list archives
[ GLSA 200904-10 ] Avahi: Denial of Service
From: Robert Buchholz <rbu () gentoo org>
Date: Thu, 9 Apr 2009 00:48:04 +0200
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200904-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Avahi: Denial of Service Date: April 08, 2009 Bugs: #260971 ID: 200904-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== An error in Avahi might lead to a Denial of Service via network and CPU consumption. Background ========== Avahi is a system that facilitates service discovery on a local network. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-dns/avahi < 0.6.24-r2 >= 0.6.24-r2 Description =========== Rob Leslie reported that the originates_from_local_legacy_unicast_socket() function in avahi-core/server.c does not account for the network byte order of a port number when processing incoming multicast packets, leading to a multicast packet storm. Impact ====== A remote attacker could send specially crafted legacy unicast mDNS query packets to the Avahi daemon, resulting in a Denial of Service due to network bandwidth and CPU consumption. Workaround ========== There is no known workaround at this time. Resolution ========== All Avahi users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/avahi-0.6.24-r2" References ========== [ 1 ] CVE-2009-0758 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0758 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200904-10.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security () gentoo org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
Attachment:
signature.asc
Description: This is a digitally signed message part.
Current thread:
- [ GLSA 200904-10 ] Avahi: Denial of Service Robert Buchholz (Apr 09)