avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0779 advisory.

  - avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of     service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this     vulnerability exists because of an incorrect fix for CVE-2010-2244. (CVE-2011-1002)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes a remote denial of service in the avahi daemon that can be triggered remotely via a null UDP packet. CVE-2011-1002: CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P): Resource Management Errors (CWE-399)

From Red Hat Security Advisory 2011:0436 :

Updated avahi packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print to, and find shared files on other computers.

A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with an empty payload. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to enter an infinite loop via an empty mDNS UDP packet.
(CVE-2011-1002)

All users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, avahi-daemon will be restarted automatically.

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print to, and find shared files on other computers.

A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with an empty payload. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to enter an infinite loop via an empty mDNS UDP packet.
(CVE-2011-1002)

This update also fixes the following bug :

  - Previously, the avahi packages in Scientific Linux 6     were not compiled with standard RPM CFLAGS; therefore,     the Stack Protector and Fortify Source protections were     not enabled, and the debuginfo packages did not contain     the information required for debugging. This update     corrects this issue by using proper CFLAGS when     compiling the packages. (BZ#629954, BZ#684276)

All users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the update, avahi-daemon will be restarted automatically.

A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with an empty payload. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to enter an infinite loop via an empty mDNS UDP packet.
(CVE-2011-1002)

After installing the update, avahi-daemon will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201110-17 (Avahi: Denial of Service)

    Multiple vulnerabilities have been discovered in Avahi. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Fixes CVE-2011-1002.

The MITRE CVE dictionary describes this issue as :

avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244.

Find out more about CVE-2011-1002 from the MITRE CVE dictionary and NIST NVD.

This also disables gtk3 support. Unfortunately gtk3 support in F14 is broken and Avahi cannot be compiled against it. Since gtk3 will not be fixed in F14 anymore and nobody uses it we instead disable it in Avahi.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated avahi packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print to, and find shared files on other computers.

A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with an empty payload. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to enter an infinite loop via an empty mDNS UDP packet.
(CVE-2011-1002)

This update also fixes the following bug :

* Previously, the avahi packages in Red Hat Enterprise Linux 6 were not compiled with standard RPM CFLAGS; therefore, the Stack Protector and Fortify Source protections were not enabled, and the debuginfo packages did not contain the information required for debugging. This update corrects this issue by using proper CFLAGS when compiling the packages. (BZ#629954, BZ#684276)

All users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the update, avahi-daemon will be restarted automatically.

Updated avahi packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print to, and find shared files on other computers.

A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with an empty payload. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to enter an infinite loop via an empty mDNS UDP packet.
(CVE-2011-1002)

All users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, avahi-daemon will be restarted automatically.

Avahi developers reports :

A vulnerability has been reported in Avahi, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error when processing certain UDP packets, which can be exploited to trigger an infinite loop by e.g. sending an empty packet to port 5353/UDP.

Fixes CVE-2011-1002 among other smaller things

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Avahi incorrectly handled empty UDP packets. A remote attacker could send a specially crafted packet and cause Avahi to hang, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in pango :

It was discovered that pango did not check for memory reallocation failures in hb_buffer_ensure() function. This could trigger a NULL pointer dereference in hb_buffer_add_glyph(), where possibly untrusted input is used as an index used for accessing members of the incorrectly reallocated array, resulting in the use of NULL address as the base array address. This can result in application crash or, possibly, code execution (CVE-2011-0064).

The updated packages have been patched to correct this issue.

It was discovered that Avahi, an implementation of the zeroconf protocol, can be crashed remotely by a single UDP packet, which may result in a denial of service.

A vulnerability has been found and corrected in avahi :

avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244 (CVE-2011-1002).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
181059	Oracle Linux 6 : avahi (ELSA-2011-0779)	Nessus	Oracle Linux Local Security Checks	high
75435	openSUSE Security Update : avahi (openSUSE-SU-2011:0149-1)	Nessus	SuSE Local Security Checks	medium
68255	Oracle Linux 5 : avahi (ELSA-2011-0436)	Nessus	Oracle Linux Local Security Checks	medium
61038	Scientific Linux Security Update : avahi on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
61017	Scientific Linux Security Update : avahi on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
56592	GLSA-201110-17 : Avahi: Denial of Service	Nessus	Gentoo Local Security Checks	medium
56151	Fedora 14 : avahi-0.6.27-8.fc14 (2011-11588)	Nessus	Fedora Local Security Checks	medium
54600	RHEL 6 : avahi (RHSA-2011:0779)	Nessus	Red Hat Local Security Checks	medium
53697	openSUSE Security Update : avahi (openSUSE-SU-2011:0149-1)	Nessus	SuSE Local Security Checks	medium
53434	CentOS 5 : avahi (CESA-2011:0436)	Nessus	CentOS Local Security Checks	medium
53400	RHEL 5 : avahi (RHSA-2011:0436)	Nessus	Red Hat Local Security Checks	medium
52666	FreeBSD : avahi -- denial of service (8b986a05-4dbe-11e0-8b9a-02e0184b8d35)	Nessus	FreeBSD Local Security Checks	medium
52664	Fedora 15 : avahi-0.6.29-1.fc15 (2011-3033)	Nessus	Fedora Local Security Checks	medium
52580	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : avahi vulnerability (USN-1084-1)	Nessus	Ubuntu Local Security Checks	medium
52541	Mandriva Linux Security Advisory : pango (MDVSA-2011:040)	Nessus	Mandriva Local Security Checks	medium
52462	Debian DSA-2174-1 : avahi - denial of service	Nessus	Debian Local Security Checks	medium
52454	Mandriva Linux Security Advisory : avahi (MDVSA-2011:037)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2011-1002

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium