The originates_from_local_legacy_unicast_socket function in avahi-core/server.c in avahi-daemon 0.6.23 does not account for the network byte order of a port number when processing incoming multicast packets, which allows remote attackers to cause a denial of service (network bandwidth and CPU consumption) via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm.

From Red Hat Security Advisory 2010:0528 :

Updated avahi packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print to, and find shared files on other computers.

A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with corrupted checksums. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to exit unexpectedly via specially crafted mDNS packets.
(CVE-2010-2244)

A flaw was found in the way avahi-daemon processed incoming unicast mDNS messages. If the mDNS reflector were enabled on a system, an attacker on the local network could send a specially crafted unicast mDNS message to that system, resulting in its avahi-daemon flooding the network with a multicast packet storm, and consuming a large amount of CPU. Note: The mDNS reflector is disabled by default.
(CVE-2009-0758)

All users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the update, avahi-daemon will be restarted automatically.

A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with corrupted checksums. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to exit unexpectedly via specially crafted mDNS packets.
(CVE-2010-2244)

A flaw was found in the way avahi-daemon processed incoming unicast mDNS messages. If the mDNS reflector were enabled on a system, an attacker on the local network could send a specially crafted unicast mDNS message to that system, resulting in its avahi-daemon flooding the network with a multicast packet storm, and consuming a large amount of CPU. Note: The mDNS reflector is disabled by default.
(CVE-2009-0758)

After installing the update, avahi-daemon will be restarted automatically.

The avahi-daemon reflector could cause packet storms when reflecting legacy unicast mDNS traffic (CVE-2009-0758). This has been fixed.

It was discovered that Avahi incorrectly handled certain mDNS query packets when the reflector feature is enabled, which is not the default configuration on Ubuntu. A remote attacker could send crafted mDNS queries and perform a denial of service on the server and on the network. This issue only affected Ubuntu 8.04 LTS and 9.04.
(CVE-2009-0758)

It was discovered that Avahi incorrectly handled mDNS packets with corrupted checksums. A remote attacker could send crafted mDNS packets and cause Avahi to crash, resulting in a denial of service.
(CVE-2010-2244).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Avahi mDNS/DNS-SD daemon. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0758     Rob Leslie discovered a denial of service vulnerability     in the code used to reflect unicast mDNS traffic.

  - CVE-2010-2244     Ludwig Nussel discovered a denial of service     vulnerability in the processing of malformed DNS     packets.

Updated avahi packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print to, and find shared files on other computers.

A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with corrupted checksums. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to exit unexpectedly via specially crafted mDNS packets.
(CVE-2010-2244)

A flaw was found in the way avahi-daemon processed incoming unicast mDNS messages. If the mDNS reflector were enabled on a system, an attacker on the local network could send a specially crafted unicast mDNS message to that system, resulting in its avahi-daemon flooding the network with a multicast packet storm, and consuming a large amount of CPU. Note: The mDNS reflector is disabled by default.
(CVE-2009-0758)

All users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the update, avahi-daemon will be restarted automatically.

The avahi-daemon reflector could cause packet storms when reflecting legacy unicast mDNS traffic (CVE-2009-0758).

A security vulnerability has been identified and fixed in avahi which could allow remote attackers to cause a denial of service (network bandwidth and CPU consumption) via a crafted legacy unicast mDNS query packet (CVE-2009-0758).

The updated packages have been patched to prevent this.

The remote host is affected by the vulnerability described in GLSA-200904-10 (Avahi: Denial of Service)

    Rob Leslie reported that the     originates_from_local_legacy_unicast_socket() function in     avahi-core/server.c does not account for the network byte order of a     port number when processing incoming multicast packets, leading to a     multicast packet storm.
  Impact :

    A remote attacker could send specially crafted legacy unicast mDNS     query packets to the Avahi daemon, resulting in a Denial of Service due     to network bandwidth and CPU consumption.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
68061	Oracle Linux 5 : avahi (ELSA-2010-0528)	Nessus	Oracle Linux Local Security Checks	high
60814	Scientific Linux Security Update : avahi on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51719	SuSE 10 Security Update : avahi (ZYPP Patch Number 6787)	Nessus	SuSE Local Security Checks	high
49831	SuSE 10 Security Update : avahi (ZYPP Patch Number 6790)	Nessus	SuSE Local Security Checks	high
49761	Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : avahi vulnerabilities (USN-992-1)	Nessus	Ubuntu Local Security Checks	high
48248	Debian DSA-2086-1 : avahi - several vulnerabilities	Nessus	Debian Local Security Checks	high
47874	RHEL 5 : avahi (RHSA-2010:0528)	Nessus	Red Hat Local Security Checks	high
47739	CentOS 5 : avahi (CESA-2010:0528)	Nessus	CentOS Local Security Checks	high
44378	SuSE 11 Security Update : avahi (SAT Patch Number 1827)	Nessus	SuSE Local Security Checks	high
44367	openSUSE Security Update : avahi (avahi-1832)	Nessus	SuSE Local Security Checks	high
44361	openSUSE Security Update : avahi (avahi-1832)	Nessus	SuSE Local Security Checks	high
37087	Mandriva Linux Security Advisory : avahi (MDVSA-2009:076)	Nessus	Mandriva Local Security Checks	high
36138	GLSA-200904-10 : Avahi: Denial of Service	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2009-0758

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high