REDHAT-BUG-1426712
First published: Fri Feb 24 2017(Updated: )
It was found that avahi responds to unicast queries coming from outside of local network which may cause an information leak, such as disclosing the device type/model that responds to the request or the operating system. The mDNS response may also be used to amplify denial of service attacks against other networks as the response size is greater than the size of request. External References: <a href="https://www.kb.cert.org/vuls/id/550620">https://www.kb.cert.org/vuls/id/550620</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Avahi AutoIP Daemon |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.kb.cert.org/vuls/id/550620
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1426717
- https://access.redhat.com/security/cve/CVE-2018-1000845
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1661252
- https://github.com/lathiat/avahi/commit/e111def44a7df4624a4aa3f85fe98054bffb6b4f
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1426712#c5
- https://access.redhat.com/errata/RHSA-2020:1176
- https://access.redhat.com/security/cve/cve-2017-6519
- https://bugzilla.redhat.com/show_bug.cgi?id=1426712
Frequently Asked Questions
What is the severity of REDHAT-BUG-1426712?
The severity of REDHAT-BUG-1426712 is considered high due to the potential for information leaks and amplification of denial of service attacks.
How do I fix REDHAT-BUG-1426712?
To fix REDHAT-BUG-1426712, it is recommended to restrict mDNS responses to the local network.
What risks are associated with REDHAT-BUG-1426712?
REDHAT-BUG-1426712 could lead to unauthorized information disclosure about device types and operating systems, as well as increased vulnerability to denial of service attacks.
Which software is affected by REDHAT-BUG-1426712?
The vulnerable software associated with REDHAT-BUG-1426712 is Avahi.
Is there a workaround for REDHAT-BUG-1426712?
A potential workaround for REDHAT-BUG-1426712 includes disabling mDNS if not needed for device discovery.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-6519
- agent/source
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/avahi
- canonical/avahi autoip daemon