Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 260971 - <net-dns/avahi DoS-0.6.24-r2 reflector creates packet storm on legacy unicast traffic (CVE-2009-0758)
Summary: <net-dns/avahi DoS-0.6.24-r2 reflector creates packet storm on legacy unicast...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://bugs.debian.org/cgi-bin/bugrep...
Whiteboard: B3 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2009-03-02 17:28 UTC by Robert Buchholz (RETIRED)
Modified: 2009-04-08 22:48 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
net-dns:avahi-0.6.24-r2:20090307-102952.log (net-dns:avahi-0.6.24-r2:20090307-102952.log,16.77 KB, text/plain)
2009-03-07 10:33 UTC, Markus Meier
no flags Details
config.log (config.log,148.40 KB, text/plain)
2009-03-07 10:34 UTC, Markus Meier
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Buchholz (RETIRED) gentoo-dev 2009-03-02 17:28:27 UTC
Rob Leslie reported that the avahi daemon creates packet storm on legacy unicast traffic, see URL for details.
Comment 1 Robert Buchholz (RETIRED) gentoo-dev 2009-03-04 17:08:42 UTC
CVE-2009-0758 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0758):
  The originates_from_local_legacy_unicast_socket function in
  avahi-core/server.c in avahi-daemon 0.6.23 does not account for the
  network byte order of a port number when processing incoming
  multicast packets, which allows remote attackers to cause a denial of
  service (network bandwidth and CPU consumption) via a crafted legacy
  unicast mDNS query packet that triggers a multicast packet storm.

Comment 2 Sven Wegener gentoo-dev 2009-03-06 14:45:33 UTC
I've applied the patch to net-dns/avahi-0.6.24-r1
Comment 3 Robert Buchholz (RETIRED) gentoo-dev 2009-03-06 18:12:31 UTC
Arches, please test and mark stable:
=net-dns/avahi-0.6.24-r1
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"
Comment 4 Sven Wegener gentoo-dev 2009-03-06 23:31:00 UTC
Please mark avahi-0.6.24-r2 stable, it contains a fix for libtool-2.
Comment 5 Markus Meier gentoo-dev 2009-03-07 10:33:52 UTC
Created attachment 184208 [details]
net-dns:avahi-0.6.24-r2:20090307-102952.log

seems to have troubles with libtool-1.5.26 here on amd64/x86.
Comment 6 Markus Meier gentoo-dev 2009-03-07 10:34:24 UTC
Created attachment 184210 [details]
config.log
Comment 7 Jeroen Roovers (RETIRED) gentoo-dev 2009-03-07 18:15:37 UTC
Stable for HPPA.
Comment 8 Tobias Klausmann (RETIRED) gentoo-dev 2009-03-08 15:59:22 UTC
Stable on alpha. 
Comment 9 Brent Baude (RETIRED) gentoo-dev 2009-03-11 13:36:27 UTC
ppc64 done
Comment 10 Raúl Porcel (RETIRED) gentoo-dev 2009-03-16 13:04:35 UTC
(In reply to comment #5)
> Created an attachment (id=184208) [edit]
> net-dns:avahi-0.6.24-r2:20090307-102952.log
> 
> seems to have troubles with libtool-1.5.26 here on amd64/x86.
> 

Same here on x86, yet on alpha doesn't give any issues with the same USE-flags :/
Comment 11 Brent Baude (RETIRED) gentoo-dev 2009-03-19 13:10:02 UTC
ppc done
Comment 12 Diego Elio Pettenò (RETIRED) gentoo-dev 2009-03-23 17:06:44 UTC
That log is not libtool, it's intltool. The ebuild lacks a dependency over a newer version of intltool.

The avahi versions released up to now use libtool 1.5 by default.
Comment 13 Raúl Porcel (RETIRED) gentoo-dev 2009-03-25 19:05:36 UTC
(In reply to comment #12)
> That log is not libtool, it's intltool. The ebuild lacks a dependency over a
> newer version of intltool.
> 
> The avahi versions released up to now use libtool 1.5 by default.
> 

Indeed, with stable intltool on x86 it works now...probably this bug should depend on the gnome stabilization.
Comment 14 Raúl Porcel (RETIRED) gentoo-dev 2009-03-27 11:26:59 UTC
arm/ia64/s390/sh/sparc/x86 stable
Comment 15 Markus Meier gentoo-dev 2009-03-29 21:28:12 UTC
amd64 stable, all arches done.
Comment 16 Robert Buchholz (RETIRED) gentoo-dev 2009-04-08 22:48:24 UTC
GLSA 200904-10