Bug 245586 (CVE-2007-3372)

Summary: CVE-2007-3372 avahi: assert fail local DoS via D-Bus
Product: [Other] Security Response Reporter: Red Hat Product Security <security-response-team>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: lpoetter
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://avahi.org/milestone/Avahi%200.6.20
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-01-08 17:07:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 476496    
Bug Blocks:    
Attachments:
Description Flags
Patch used by Ubuntu in USN-696 none

Description Lubomir Kundrak 2007-06-25 15:52:20 UTC 
Description of problem:

Avahi 0.6.20 was issued fixing a local Denial of Service flaw, where a local
attacker could crash Avahi daemon by sending a crafted message via D-Bus.
Comment 2 Tomas Hoger 2008-12-19 08:27:46 UTC 
Upstream fix:
http://avahi.org/changeset/b5daab9d464d239b0bf24379c6472ba09af35f66
Comment 5 Tomas Hoger 2009-01-08 08:51:14 UTC 
Original report with PoC:
http://lists.freedesktop.org/archives/avahi/2007-May/001058.html
Comment 7 Tomas Hoger 2009-01-08 09:27:50 UTC 
Created attachment 328453 [details]
Patch used by Ubuntu in USN-696

http://www.ubuntu.com/usn/usn-696-1
Comment 8 Tomas Hoger 2009-01-08 09:30:56 UTC 
Looks like the issue may have been introduced in 0.6.17 via following commit:
http://avahi.org/changeset/8b792d513254e334b7ead4e47dd3f37b23b06e77

Older versions use dbus_message_iter_get_array_len() and set k to "" when empty array is received.
Comment 9 Tomas Hoger 2009-01-08 17:07:23 UTC 
Confirmed with upstream that this issue was indeed introduced in 0.6.17, as is now noted on the upstream security page:
  http://avahi.org/wiki/AvahiSecurity

avahi version shipped in Red Hat Enterprise Linux 5 is 0.6.16 and was not affected by this flaw.  All current Fedora versions ship post-0.6.20 version and therefore have the fix included.
Comment 10 Red Hat Bugzilla 2009-10-23 19:05:43 UTC 
Reporter changed to security-response-team by request of Jay Turner.