PT-2017-3764 · Avahi+5 · Avahi+5

Published 2017-04-30 · Updated 2025-12-03 · CVE-2017-6519

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Avahi versions 0.6.32 through 0.7

Description: The issue is related to the avahi-daemon in Avahi, which inadvertently responds to IPv6 unicast queries with source addresses that are not on-link. This allows remote attackers to cause a denial of service (traffic amplification) and may lead to information leakage by obtaining potentially sensitive information from the responding device via port-5353 UDP packets.

Recommendations: For Avahi versions 0.6.32 through 0.7, consider disabling the avahi-daemon service as a temporary workaround to minimize the risk of exploitation. Restrict access to port 5353 to prevent UDP packets from reaching the vulnerable service.

Exploit

Fix

DoS

Origin Validation Error

Improper Access Control

Weakness Enumeration

CWE-346

CWE-284

Related Identifiers

ALT-PU-2019-2684

ALT-PU-2020-2452

ALT-PU-2020-2940

AZL-6322

BDU:2019-00693

CESA-2020_1176

CVE-2017-6519

MGASA-2019-0081

OPENSUSE-SU-2024:10643-1

RHSA-2020:1176

RHSA-2020_1176

USN-3876-1

USN-3876-2

Affected Products

Alt Linux

Astra Linux

Avahi

Centos

Red Hat

Ubuntu

References · 47

• 🔥 https://github.com/lathiat/avahi/issues/203 · Exploit
• https://bdu.fstec.ru/vul/2019-00693 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-6519 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3876-2 · Vendor Advisory
• https://usn.ubuntu.com/3876-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2022-0819SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://usn.ubuntu.com/3876-2 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1176.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6519 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6519 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6519 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1426712 · Patch
• https://osv.dev/vulnerability/USN-3876-1 · Vendor Advisory