DSA-2086

Executive Summary

Summary
Title	New avahi packages fix denial of service

Informations
Name	DSA-2086	First vendor Publication	2010-08-04
Vendor	Debian	Last vendor Modification	2010-08-04
Severity (Vendor)	N/A	Revision	1

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C)
Cvss Base Score	7.8	Attack Range	Network
Cvss Impact Score	6.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Several vulnerabilities have been discovered in the Avahi mDNS/DNS-SD daemon. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2009-0758

Rob Leslie discovered a denial of service vulnerability in the code used to reflect unicast mDNS traffic.

CVE-2010-2244

Ludwig Nussel discovered a denial of service vulnerability in the processing of malformed DNS packets.

For the stable distribution (lenny), this problem has been fixed in version 0.6.23-3lenny2.

For the unstable distribution (sid), these problems have been fixed in version 0.6.26-1.

We recommend that you upgrade your Avahi packages.

Original Source

Url : http://www.debian.org/security/2010/dsa-2086

CWE : Common Weakness Enumeration

id	Name
CWE-399	Resource Management Errors

CPE : Common Platform Enumeration

Type	Description	Count
Application	Avahi Avahi cpe:/a:avahi:avahi:0.6.25 cpe:/a:avahi:avahi:0.6.16	2
Application	Avahi Avahi-Daemon cpe:/a:avahi:avahi-daemon:0.6.23	1

Open Source Vulnerability Database (OSVDB)

id	Description
66038	Avahi avahi-core/socket.c Multiple Function DNS Packet Remote DoS
52543	avahi-daemon avahi-core/server.c originates_from_local_legacy_unicast_socket ...