A reachable assertion was found in avahirdataparse.
References:
https://github.com/lathiat/avahi/issues/452
A reachable assertion was found in avahidnspacketappendrecord.
References:
https://github.com/lathiat/avahi/issues/455
It was discovered that the avahi deamon can be locally crashed by a dbus call made by an unprivileged user, causing a denial of service.
References:
https://github.com/lathiat/avahi/issues/375
A local Dos in avahi-daemon that can be triggered by trying to resolve badly-formatted hostnames on the /run/avahi-daemon/socket interface.
References:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=986018
A flaw was found in avahi deamon. Denial of service can be triggered by writing long lines to /run/avahi-daemon/socket resulting in an unresponsive busy-loop of the daemon.
References:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=984938
It was found that avahi responds to unicast queries coming from outside of local network which may cause an information leak, such as disclosing the device type/model that responds to the request or the operating system. The mDNS response may also be used to amplify denial of service attacks against other networks as the response size is greater than the size of request.
External References:
https://www.kb.cert.org/vuls/id/550620
REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-1002. Reason: This candidate is a reservation duplicate of CVE-2011-1002. Notes: All CVE users should reference CVE-2011-1002 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244.
Ludwig Nussel reported: [1] http://www.openwall.com/lists/oss-security/2010/06/23/4
a deficiency in the way avahi daemon processed packets with corrupted checksum(s). A remote attacker on the same local are network (LAN) could send a DNS packet with broken checksum, that would cause avahi-daemon to exit unexpectedly due to a failed assertion check. Different vulnerability than CVE-2008-5081.
Ludwig Nussel reported: [1] http://www.openwall.com/lists/oss-security/2010/06/23/4
a deficiency in the way avahi daemon processed packets with corrupted checksum(s). A remote attacker on the same local are network (LAN) could send a DNS packet with broken checksum, that would cause avahi-daemon to exit unexpectedly due to a failed assertion check. Different vulnerability than CVE-2008-5081.
Hugo Dias of the Synchron Security Labs discovered a remote denial of service flaw in the avahi daemon. A crafted multicast DNS (mDNS) packet with source port 0 can trigger assertion in originatesfromlocallegacyunicastsocket() function in avahi-core/server.c -- assert(port > 0); -- causing the daemon to call abort() and exit unexpectedly.
Scope of this attack is usually limited to a single LAN.
Hugo Dias of the Synchron Security Labs discovered a remote denial of service flaw in the avahi daemon. A crafted multicast DNS (mDNS) packet with source port 0 can trigger assertion in originatesfromlocallegacyunicastsocket() function in avahi-core/server.c -- assert(port > 0); -- causing the daemon to call abort() and exit unexpectedly.
Scope of this attack is usually limited to a single LAN.