Ubuntu 5.10 / 6.06 LTS / 6.10 : avahi vulnerability (USN-380-1)

Steve Grubb discovered that netlink messages were not being checked for their sender identity. This could lead to local users manipulating the Avahi service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has...

openSUSE 10 Security Update : avahi (avahi-2217)

Avahi did not check that the received netlink messages originated from the kernel. This could be used by local attackers to inject packets into avahi which could be used to inject bad netlink messages into Avahi, confusing its routing code or worse. CVE-2006-5461 %NASLMINLEVEL 70300 C Tenable...

openSUSE 10 Security Update : avahi (avahi-2982)

This update fixes a remote denial of service problem in avahi, where attackers could cause an endless loop. CVE-2006-6870 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update avahi-2982. The text...

openSUSE 10 Security Update : avahi (avahi-3846)

Local attackers could send empty TXT data via D-BUS, causing the avahi daemon to exit. CVE-2007-3372 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update avahi-3846...

openSUSE 10 Security Update : avahi (avahi-1399)

A local exploitable buffer overflow has been found in avahi. The impact is low since avahi is running in a chroot environment. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update avahi-1399. The...

Mandrake Linux Security Advisory : avahi (MDKSA-2007:185)

The Avahi daemon in 0.6.20 and previous allows attackers to cause a denial of service via empty TXT data over D-Bus, which triggers an assert error. Updated packages have been patched to prevent this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

Avahi DBUS DoS

Empty TXT record causes daemon to crash...

Design/Logic Flaw

The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service exit via empty TXT data over D-Bus, which triggers an assert error...

CVE-2007-3372

The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service exit via empty TXT data over D-Bus, which triggers an assert error...

CVE-2007-3372

The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service exit via empty TXT data over D-Bus, which triggers an assert error...

DEBIAN-CVE-2007-3372

The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service exit via empty TXT data over D-Bus, which triggers an assert error...

CVE-2007-3372

The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service exit via empty TXT data over D-Bus, which triggers an assert error...

CVE-2007-3372

The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service exit via empty TXT data over D-Bus, which triggers an assert error...

CVE-2007-3372

CVE-2007-3372 affects the Avahi daemon, with vulnerable releases prior to 0.6.20. An attacker can trigger a denial of service by sending empty TXT data over D-Bus, causing an assertion failure. A fix is available in Avahi 0.6.20 and later (updates referenced in the milestoned changeset). If apply...

CVE-2007-3372

The Avahi daemon in Avahi before 0.6.20 allows attackers to cause a denial of service exit via empty TXT data over D-Bus, which triggers an assert error...

Mandrake Linux Security Advisory : avahi (MDKSA-2007:003)

The consumelabels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service infinite loop via a crafted compressed DNS response with a label that points to itself. Updated packages are patched to address this issue. %NASLMINLEVEL 70300 C Tenable...

Mandrake Linux Security Advisory : avahi (MDKSA-2006:215)

Steve Grubb discovered that netlink messages were not being checked for their sender identity. This could lead to local users manipulating the Avahi service. Packages have been patched to correct this issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Fedora Core 5 : avahi-0.6.11-3.fc5 (2007-018)

avahi-0.6.11-3.fc5 should fix CVE-2006-6870 - the consumelabels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service infinite loop via a crafted compressed DNS response with a label that points to itself. Note that Tenable Network Security has...

Fedora Core 6 : avahi-0.6.16-1.fc6 (2007-019)

This update shoul fix CVE-2006-6870 reported in 221440. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora Core 6 : avahi-0.6.15-1.fc6 (2006-1340)

Avahi before 0.6.15 does not verify the sender identity of netlink messages to ensure that they come from the kernel instead of another process, which allows local users to spoof network changes to Avahi. Note that Tenable Network Security has extracted the preceding description block directly fr...