The originates_from_local_legacy_unicast_socket function in avahi-core/server.c in avahi-daemon 0.6.23 does not account for the network byte order of a port number when processing incoming multicast packets, which allows remote attackers to cause a denial of service (network bandwidth and CPU consumption) via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade avahi-glibUpgrade avahi-qt3Upgrade avahi-compat-howlUpgrade avahi-compat-howl-develUpgrade avahi-toolsUpgrade avahi-glib-develUpgrade avahi-compat-libdns_sd-develUpgrade avahiUpgrade avahi-compat-libdns_sdUpgrade avahi-develUpgrade avahi-qt3-devel | Dec 1, 2016 | Mar 3, 2009 |
| Debian | — | Upgrade avahi | Jul 30, 2024 | Mar 3, 2009 |
| Gentoo Linux | — | Upgrade net-dns/avahi. | Oct 30, 2017 | Mar 3, 2009 |
| Oracle_linux | — | Upgrade avahiUpgrade avahi-compat-libdns_sd-develUpgrade avahi-glibUpgrade avahi-compat-libdns_sdUpgrade avahi-glib-develUpgrade avahi-qt3Upgrade avahi-qt3-develUpgrade avahi-toolsUpgrade avahi-compat-howl-develUpgrade avahi-develUpgrade avahi-compat-howl | Oct 16, 2024 | Mar 3, 2009 |
| Suse | — | Upgrade libhowl0Upgrade libdns_sdUpgrade libavahi-client3-32bitUpgrade libavahi-glib-develUpgrade avahi-autoipdUpgrade typelib-1_0-Avahi-0_6Upgrade libavahi-client3-x86Upgrade libavahi-core5Upgrade libavahi-core7Upgrade libdns_sd-32bitUpgrade python-avahiUpgrade avahi-utilsUpgrade libavahi-glib1Upgrade avahi-compat-howl-develUpgrade libavahi-libevent1Upgrade libavahi-common3-32bitUpgrade libavahi-common3Upgrade libavahi-qt6-1Upgrade libavahi-gobject-develUpgrade avahi-utils-gtkUpgrade avahiUpgrade libdns_sd-x86Upgrade avahi-langUpgrade python313-avahiUpgrade libavahi-ui-gtk3-0Upgrade avahi-compat-mDNSResponder-develUpgrade libavahi-common3-x86Upgrade libavahi-qt6-develUpgrade libavahi-gobject0Upgrade libavahi-client3Upgrade libavahi-develUpgrade python3-avahi-gtk | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libavahi-core5Upgrade libavahi-core6 | Nov 8, 2024 | Mar 3, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub