Lucene search

K

Huawei EulerOS: Security Advisory for avahi (EulerOS-SA-2021-2454)

🗓️ 24 Sep 2021 00:00:00Reported by Copyright (C) 2021 Greenbone AGType 
openvas
 openvas
🔗 plugins.openvas.org👁 13 Views

Huawei EulerOS avahi package vulnerability (SA-2021-2454) handling incorrect event in client connection can lead to a denial of service

Show more
Related
Refs
Code
ReporterTitlePublishedViews
Family
RedhatCVE
CVE-2021-3468
26 Mar 202114:06
redhatcve
OSV
CVE-2021-3468
2 Jun 202116:15
osv
OSV
CGA-h88c-2gpj-jff4
6 Jun 202412:27
osv
OSV
avahi - security update
21 Jun 202300:00
osv
OSV
avahi vulnerability
7 Jul 202119:17
osv
OSV
avahi - security update
7 Jun 202200:00
osv
OSV
avahi vulnerabilities
7 Jul 202117:19
osv
OSV
Moderate: avahi security update
7 Nov 202300:00
osv
OSV
Red Hat Security Advisory: avahi security update
16 Sep 202413:09
osv
OSV
Moderate: avahi security update
14 Dec 202300:00
osv
Rows per page
# SPDX-FileCopyrightText: 2021 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.1.2.2021.2454");
  script_cve_id("CVE-2021-3468");
  script_tag(name:"creation_date", value:"2021-09-24 02:24:28 +0000 (Fri, 24 Sep 2021)");
  script_version("2024-02-05T14:36:56+0000");
  script_tag(name:"last_modification", value:"2024-02-05 14:36:56 +0000 (Mon, 05 Feb 2024)");
  script_tag(name:"cvss_base", value:"2.1");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:N/C:N/I:N/A:P");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2021-06-09 20:03:11 +0000 (Wed, 09 Jun 2021)");

  script_name("Huawei EulerOS: Security Advisory for avahi (EulerOS-SA-2021-2454)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2021 Greenbone AG");
  script_family("Huawei EulerOS Local Security Checks");
  script_dependencies("gb_huawei_euleros_consolidation.nasl");
  script_mandatory_keys("ssh/login/euleros", "ssh/login/rpms", re:"ssh/login/release=EULEROS\-2\.0SP8");

  script_xref(name:"Advisory-ID", value:"EulerOS-SA-2021-2454");
  script_xref(name:"URL", value:"https://developer.huaweicloud.com/intl/en-us/euleros/securitydetail.html?secId=EulerOS-SA-2021-2454");

  script_tag(name:"summary", value:"The remote host is missing an update for the Huawei EulerOS 'avahi' package(s) announced via the EulerOS-SA-2021-2454 advisory.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");

  script_tag(name:"insight", value:"A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.(CVE-2021-3468)");

  script_tag(name:"affected", value:"'avahi' package(s) on Huawei EulerOS V2.0SP8.");

  script_tag(name:"solution", value:"Please install the updated package(s).");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"package");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-rpm.inc");

release = rpm_get_ssh_release();
if(!release)
  exit(0);

res = "";
report = "";

if(release == "EULEROS-2.0SP8") {

  if(!isnull(res = isrpmvuln(pkg:"avahi", rpm:"avahi~0.7~16.h8.eulerosv2r8", rls:"EULEROS-2.0SP8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"avahi-autoipd", rpm:"avahi-autoipd~0.7~16.h8.eulerosv2r8", rls:"EULEROS-2.0SP8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"avahi-devel", rpm:"avahi-devel~0.7~16.h8.eulerosv2r8", rls:"EULEROS-2.0SP8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"avahi-glib", rpm:"avahi-glib~0.7~16.h8.eulerosv2r8", rls:"EULEROS-2.0SP8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"avahi-gobject", rpm:"avahi-gobject~0.7~16.h8.eulerosv2r8", rls:"EULEROS-2.0SP8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"avahi-libs", rpm:"avahi-libs~0.7~16.h8.eulerosv2r8", rls:"EULEROS-2.0SP8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"avahi-ui-gtk3", rpm:"avahi-ui-gtk3~0.7~16.h8.eulerosv2r8", rls:"EULEROS-2.0SP8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"python2-avahi", rpm:"python2-avahi~0.7~16.h8.eulerosv2r8", rls:"EULEROS-2.0SP8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"python3-avahi", rpm:"python3-avahi~0.7~16.h8.eulerosv2r8", rls:"EULEROS-2.0SP8"))) {
    report += res;
  }

  if(report != "") {
    security_message(data:report);
  } else if(__pkg_match) {
    exit(99);
  }
  exit(0);
}

exit(0);

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
24 Sep 2021 00:00Current
6.0Medium risk
Vulners AI Score6.0
EPSS0.000
13
.json
Report