avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE) not the upstream Avahi product.

🗓️ 16 Dec 2021 08:00:00Reported by MicrosoftType

Root execution of avahi-daemon-check-dns.sh in Debian packaging enables local denial of service.

Reporter	Title	Published	Views	Family All 59
ATTACKERKB	CVE-2021-26720	17 Feb 202122:15	–	attackerkb
AlpineLinux	CVE-2021-26720	17 Feb 202121:19	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in avahi	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the avahi-daemon-check-dns.sh component of the Avahi service discovery system in local networks allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.	28 Sep 202200:00	–	bdu_fstec
CBLMariner	CVE-2021-26720 affecting package avahi for versions less than 0.8-1	19 Mar 202417:21	–	cbl_mariner
CBLMariner	CVE-2021-26720 affecting package avahi for versions less than 0.8-1	26 Apr 202219:39	–	cbl_mariner
Circl	CVE-2021-26720	18 Feb 202100:49	–	circl
CNNVD	Debian avahi backlink vulnerability	17 Feb 202100:00	–	cnnvd
CVE	CVE-2021-26720	17 Feb 202121:19	–	cve
Cvelist	CVE-2021-26720	17 Feb 202121:19	–	cvelist