The AvahiDnsPacket function in avahi-core/socket.c in avahi-daemon in Avahi 0.6.16 and 0.6.25 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNS packet with an invalid checksum followed by a DNS packet with a valid checksum, a different vulnerability than CVE-2008-5081.

From Red Hat Security Advisory 2010:0528 :

Updated avahi packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print to, and find shared files on other computers.

A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with corrupted checksums. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to exit unexpectedly via specially crafted mDNS packets.
(CVE-2010-2244)

A flaw was found in the way avahi-daemon processed incoming unicast mDNS messages. If the mDNS reflector were enabled on a system, an attacker on the local network could send a specially crafted unicast mDNS message to that system, resulting in its avahi-daemon flooding the network with a multicast packet storm, and consuming a large amount of CPU. Note: The mDNS reflector is disabled by default.
(CVE-2009-0758)

All users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the update, avahi-daemon will be restarted automatically.

A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with corrupted checksums. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to exit unexpectedly via specially crafted mDNS packets.
(CVE-2010-2244)

A flaw was found in the way avahi-daemon processed incoming unicast mDNS messages. If the mDNS reflector were enabled on a system, an attacker on the local network could send a specially crafted unicast mDNS message to that system, resulting in its avahi-daemon flooding the network with a multicast packet storm, and consuming a large amount of CPU. Note: The mDNS reflector is disabled by default.
(CVE-2009-0758)

After installing the update, avahi-daemon will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201110-17 (Avahi: Denial of Service)

    Multiple vulnerabilities have been discovered in Avahi. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Fixes CVE-2011-1002.

The MITRE CVE dictionary describes this issue as :

avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244.

Find out more about CVE-2011-1002 from the MITRE CVE dictionary and NIST NVD.

This also disables gtk3 support. Unfortunately gtk3 support in F14 is broken and Avahi cannot be compiled against it. Since gtk3 will not be fixed in F14 anymore and nobody uses it we instead disable it in Avahi.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Avahi developers reports :

A vulnerability has been reported in Avahi, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error when processing certain UDP packets, which can be exploited to trigger an infinite loop by e.g. sending an empty packet to port 5353/UDP.

Fixes CVE-2011-1002 among other smaller things

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered and corrected in avahi :

The AvahiDnsPacket function in avahi-core/socket.c in avahi-daemon in Avahi 0.6.16 and 0.6.25 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNS packet with an invalid checksum followed by a DNS packet with a valid checksum, a different vulnerability than CVE-2008-5081 (CVE-2010-2244).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

It was discovered that Avahi incorrectly handled certain mDNS query packets when the reflector feature is enabled, which is not the default configuration on Ubuntu. A remote attacker could send crafted mDNS queries and perform a denial of service on the server and on the network. This issue only affected Ubuntu 8.04 LTS and 9.04.
(CVE-2009-0758)

It was discovered that Avahi incorrectly handled mDNS packets with corrupted checksums. A remote attacker could send crafted mDNS packets and cause Avahi to crash, resulting in a denial of service.
(CVE-2010-2244).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Avahi mDNS/DNS-SD daemon. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0758     Rob Leslie discovered a denial of service vulnerability     in the code used to reflect unicast mDNS traffic.

  - CVE-2010-2244     Ludwig Nussel discovered a denial of service     vulnerability in the processing of malformed DNS     packets.

Updated avahi packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print to, and find shared files on other computers.

A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with corrupted checksums. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to exit unexpectedly via specially crafted mDNS packets.
(CVE-2010-2244)

A flaw was found in the way avahi-daemon processed incoming unicast mDNS messages. If the mDNS reflector were enabled on a system, an attacker on the local network could send a specially crafted unicast mDNS message to that system, resulting in its avahi-daemon flooding the network with a multicast packet storm, and consuming a large amount of CPU. Note: The mDNS reflector is disabled by default.
(CVE-2009-0758)

All users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the update, avahi-daemon will be restarted automatically.

Fix for CVE-2010-2244.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
68061	Oracle Linux 5 : avahi (ELSA-2010-0528)	Nessus	Oracle Linux Local Security Checks	high
60814	Scientific Linux Security Update : avahi on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
56592	GLSA-201110-17 : Avahi: Denial of Service	Nessus	Gentoo Local Security Checks	medium
56151	Fedora 14 : avahi-0.6.27-8.fc14 (2011-11588)	Nessus	Fedora Local Security Checks	medium
52666	FreeBSD : avahi -- denial of service (8b986a05-4dbe-11e0-8b9a-02e0184b8d35)	Nessus	FreeBSD Local Security Checks	medium
52664	Fedora 15 : avahi-0.6.29-1.fc15 (2011-3033)	Nessus	Fedora Local Security Checks	medium
49989	Mandriva Linux Security Advisory : avahi (MDVSA-2010:204)	Nessus	Mandriva Local Security Checks	medium
49761	Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : avahi vulnerabilities (USN-992-1)	Nessus	Ubuntu Local Security Checks	high
48248	Debian DSA-2086-1 : avahi - several vulnerabilities	Nessus	Debian Local Security Checks	high
47874	RHEL 5 : avahi (RHSA-2010:0528)	Nessus	Red Hat Local Security Checks	high
47739	CentOS 5 : avahi (CESA-2010:0528)	Nessus	CentOS Local Security Checks	high
47610	Fedora 12 : avahi-0.6.25-7.fc12 (2010-10584)	Nessus	Fedora Local Security Checks	medium
47609	Fedora 13 : avahi-0.6.25-7.fc13 (2010-10581)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-2244

high

Tenable Plugins

high

high

medium

medium

medium

medium

medium

high

high

high

high

medium

medium