CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS
Percentile
94.1%
CentOS Errata and Security Advisory CESA-2011:0436
Avahi is an implementation of the DNS Service Discovery and Multicast DNS
specifications for Zero Configuration Networking. It facilitates service
discovery on a local network. Avahi and Avahi-aware applications allow you
to plug your computer into a network and, with no configuration, view other
people to chat with, view printers to print to, and find shared files on
other computers.
A flaw was found in the way the Avahi daemon (avahi-daemon) processed
Multicast DNS (mDNS) packets with an empty payload. An attacker on the
local network could use this flaw to cause avahi-daemon on a target system
to enter an infinite loop via an empty mDNS UDP packet. (CVE-2011-1002)
All users are advised to upgrade to these updated packages, which contain
a backported patch to correct this issue. After installing the update,
avahi-daemon will be restarted automatically.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2011-April/079455.html
https://lists.centos.org/pipermail/centos-announce/2011-April/079456.html
Affected packages:
avahi
avahi-compat-howl
avahi-compat-howl-devel
avahi-compat-libdns_sd
avahi-compat-libdns_sd-devel
avahi-devel
avahi-glib
avahi-glib-devel
avahi-qt3
avahi-qt3-devel
avahi-tools
Upstream details at:
https://access.redhat.com/errata/RHSA-2011:0436
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 5 | i386 | avahi | < 0.6.16-10.el5_6 | avahi-0.6.16-10.el5_6.i386.rpm |
CentOS | 5 | i386 | avahi-compat-howl | < 0.6.16-10.el5_6 | avahi-compat-howl-0.6.16-10.el5_6.i386.rpm |
CentOS | 5 | i386 | avahi-compat-howl-devel | < 0.6.16-10.el5_6 | avahi-compat-howl-devel-0.6.16-10.el5_6.i386.rpm |
CentOS | 5 | i386 | avahi-compat-libdns_sd | < 0.6.16-10.el5_6 | avahi-compat-libdns_sd-0.6.16-10.el5_6.i386.rpm |
CentOS | 5 | i386 | avahi-compat-libdns_sd-devel | < 0.6.16-10.el5_6 | avahi-compat-libdns_sd-devel-0.6.16-10.el5_6.i386.rpm |
CentOS | 5 | i386 | avahi-devel | < 0.6.16-10.el5_6 | avahi-devel-0.6.16-10.el5_6.i386.rpm |
CentOS | 5 | i386 | avahi-glib | < 0.6.16-10.el5_6 | avahi-glib-0.6.16-10.el5_6.i386.rpm |
CentOS | 5 | i386 | avahi-glib-devel | < 0.6.16-10.el5_6 | avahi-glib-devel-0.6.16-10.el5_6.i386.rpm |
CentOS | 5 | i386 | avahi-qt3 | < 0.6.16-10.el5_6 | avahi-qt3-0.6.16-10.el5_6.i386.rpm |
CentOS | 5 | i386 | avahi-qt3-devel | < 0.6.16-10.el5_6 | avahi-qt3-devel-0.6.16-10.el5_6.i386.rpm |