The originates_from_local_legacy_unicast_socket function in avahi-core/server.c in avahi-daemon 0.6.23 does not account for the network byte order of a port number when processing incoming multicast packets, which allows remote attackers to cause a denial of service (network bandwidth and CPU consumption) via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade avahi-qt3Upgrade avahi-glibUpgrade avahi-compat-howl-develUpgrade avahi-compat-howlUpgrade avahi-toolsUpgrade avahi-glib-develUpgrade avahi-develUpgrade avahiUpgrade avahi-qt3-develUpgrade avahi-compat-libdns_sd-develUpgrade avahi-compat-libdns_sd | Dec 1, 2016 | Mar 3, 2009 |
| Debian | — | Upgrade avahi | Jul 30, 2024 | Mar 3, 2009 |
| Gentoo Linux | — | Upgrade net-dns/avahi. | Oct 30, 2017 | Mar 3, 2009 |
| Oracle_linux | — | Upgrade avahi-compat-howl-develUpgrade avahi-qt3Upgrade avahi-qt3-develUpgrade avahi-compat-howlUpgrade avahi-develUpgrade avahi-toolsUpgrade avahiUpgrade avahi-compat-libdns_sd-develUpgrade avahi-glibUpgrade avahi-glib-develUpgrade avahi-compat-libdns_sd | Oct 16, 2024 | Mar 3, 2009 |
| Suse | — | Upgrade libhowl0Upgrade libavahi-glib-develUpgrade typelib-1_0-Avahi-0_6Upgrade libavahi-core5Upgrade libavahi-client3-x86Upgrade libdns_sdUpgrade libavahi-core7Upgrade avahi-autoipdUpgrade libavahi-client3-32bitUpgrade libavahi-ui-gtk3-0Upgrade libavahi-qt6-develUpgrade python3-avahi-gtkUpgrade python313-avahiUpgrade avahi-compat-howl-develUpgrade libdns_sd-32bitUpgrade avahiUpgrade libavahi-common3-32bitUpgrade python-avahiUpgrade libavahi-qt6-1Upgrade libavahi-client3Upgrade avahi-langUpgrade avahi-utils-gtkUpgrade libavahi-libevent1Upgrade libavahi-gobject0Upgrade libavahi-develUpgrade libavahi-common3Upgrade libdns_sd-x86Upgrade libavahi-glib1Upgrade avahi-utilsUpgrade libavahi-gobject-develUpgrade avahi-compat-mDNSResponder-develUpgrade libavahi-common3-x86 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libavahi-core6Upgrade libavahi-core5 | Nov 8, 2024 | Mar 3, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub