oss-security - Avahi daemon DoS (CVE-2008-5081)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [month] [year] [list]

Date: Sun, 14 Dec 2008 11:32:26 +0100
From: Tomas Hoger <thoger@...hat.com>
To: OSS Security <oss-security@...ts.openwall.com>
Cc: hdias@...chlabs.com
Subject: Avahi daemon DoS (CVE-2008-5081)

Hi!

New avahi upstream release 0.6.24 was released on Friday.
  http://avahi.org/milestone/Avahi%200.6.24

Security issue mentioned in the DoS flaw reported by Hugo Dias.
Crafted mDNS packet with source port 0 can cause avahi-daemon to
abort() due to failed assertion assert(port > 0); in
originates_from_local_legacy_unicast_socket() function in
avahi-core/server.c.

Upstream commit:
http://git.0pointer.de/?p=avahi.git;a=commitdiff;h=3093047f1aa36bed8a37fa79004bf0ee287929f4

CVE CVE-2008-5081 was assigned to this issue.

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.