Re: [NSE] Broadcast script to detect CVE-2011-1002 (Avahi NULL UDP DoS)

[David Fifield <david () bamsoftware com>]

On Wed, Mar 09, 2011 at 11:17:20AM +0100, Djalal Harouni wrote:
> Hi,
>
> Since the Avahi NULL UDP DoS [1] has been patched and since every one
> can test this vulnerability with every tool that sends UDP packet.
> I'm sharing an attached script that I wrote the other days to
> automatically discover hosts on the local network using the DNS Service
> Discovery protocol and test each host to see if it's vulnerable
> (you will DoS your hosts or network). The script uses the prerule.
>
> I thought this can help Nmap pen-testers. I've tested the script
> on some default ubuntu machines and on an embedded device, yes avahi
> can run on some embedded devices.
>
> [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002

Does a normal Nmap UDP port scan also kill Avahi? I guess not, because
UDP payloads are enabled by default and we have one for port 5353. What
about with --data-length 0?

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/