PT-2009-1085 · Avahi+1 · Avahi-Daemon+1

Steffen Joeris · Publicado 2009-03-03 · Atualizado 2024-06-15 · CVE-2009-0758

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions avahi-daemon versions 0.6.23 through 0.6.24-r2 avahi-daemon version 0.6.23

Description The issue is related to the originates from local legacy unicast socket function in avahi-daemon, which does not properly handle the network byte order of a port number when processing incoming multicast packets. This allows remote attackers to cause a denial of service by consuming network bandwidth and CPU resources via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm. The vulnerability can be exploited remotely and may lead to disruption of protected information availability.

Recommendations For avahi-daemon versions 0.6.23 through 0.6.24-r2, update to version 0.6.24-r2 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2015-09386

CVE-2009-0758

DSA-2086-1

OPENSUSE-SU-2024:10363-1

RHSA-2010:0528

RHSA-2010_0528

Produtos afetados

Red Hat

Avahi-Daemon

Referências · 21

• http://openwall.com/lists/oss-security/2009/03/02/1 · Nota
• https://osv.dev/vulnerability/CVE-2009-0758 · Aviso do Fabricante
• http://securityfocus.com/bid/33946 · Nota
• http://debian.org/security/2010/dsa-2086 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-1002 · Nota
• https://access.redhat.com/errata/RHSA-2010:0528 · Nota
• https://security-tracker.debian.org/tracker/CVE-2009-0758 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-2244 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10363-1 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2009:076 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09386 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2009-0758 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00000.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2009-0758 · Nota
• http://secunia.com/advisories/38420 · Nota