REDHAT-BUG-1426712: Low severity avahi autoip daemon vulnerability
It was found that avahi responds to unicast queries coming from outside of local network which may cause an information leak, such as disclosing the device type/model that responds to the request or the operating system. The mDNS response may also be used to amplify denial of service attacks against other networks as the response size is greater than the size of request.
External References:
https://www.kb.cert.org/vuls/id/550620
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1426712?
The severity of REDHAT-BUG-1426712 is considered high due to the potential for information leaks and amplification of denial of service attacks.
How do I fix REDHAT-BUG-1426712?
To fix REDHAT-BUG-1426712, it is recommended to restrict mDNS responses to the local network.
What risks are associated with REDHAT-BUG-1426712?
REDHAT-BUG-1426712 could lead to unauthorized information disclosure about device types and operating systems, as well as increased vulnerability to denial of service attacks.
Which software is affected by REDHAT-BUG-1426712?
The vulnerable software associated with REDHAT-BUG-1426712 is Avahi.
Is there a workaround for REDHAT-BUG-1426712?
A potential workaround for REDHAT-BUG-1426712 includes disabling mDNS if not needed for device discovery.