Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 245586 - (CVE-2007-3372) CVE-2007-3372 avahi: assert fail local DoS via D-Bus
CVE-2007-3372 avahi: assert fail local DoS via D-Bus
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 476496
  Show dependency treegraph
Reported: 2007-06-25 11:52 EDT by Red Hat Product Security
Modified: 2009-10-23 15:05 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-01-08 12:07:23 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Patch used by Ubuntu in USN-696 (1.22 KB, patch)
2009-01-08 04:27 EST, Tomas Hoger
no flags Details | Diff

  None (edit)
Description Lubomir Kundrak 2007-06-25 11:52:20 EDT
Description of problem:

Avahi 0.6.20 was issued fixing a local Denial of Service flaw, where a local
attacker could crash Avahi daemon by sending a crafted message via D-Bus.
Comment 2 Tomas Hoger 2008-12-19 03:27:46 EST
Upstream fix:
Comment 5 Tomas Hoger 2009-01-08 03:51:14 EST
Original report with PoC:
Comment 7 Tomas Hoger 2009-01-08 04:27:50 EST
Created attachment 328453 [details]
Patch used by Ubuntu in USN-696

Comment 8 Tomas Hoger 2009-01-08 04:30:56 EST
Looks like the issue may have been introduced in 0.6.17 via following commit:

Older versions use dbus_message_iter_get_array_len() and set k to "" when empty array is received.
Comment 9 Tomas Hoger 2009-01-08 12:07:23 EST
Confirmed with upstream that this issue was indeed introduced in 0.6.17, as is now noted on the upstream security page:

avahi version shipped in Red Hat Enterprise Linux 5 is 0.6.16 and was not affected by this flaw.  All current Fedora versions ship post-0.6.20 version and therefore have the fix included.
Comment 10 Red Hat Bugzilla 2009-10-23 15:05:43 EDT
Reporter changed to security-response-team@redhat.com by request of Jay Turner.

Note You need to log in before you can comment on or make changes to this bug.