Bug 488314 - (CVE-2009-0758) CVE-2009-0758 avahi: remote DoS via legacy unicast mDNS queries
CVE-2009-0758 avahi: remote DoS via legacy unicast mDNS queries
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
http://web.nvd.nist.gov/view/vuln/det...
impact=low,source=debian,reported=200...
: Reopened, Security
Depends On: 609318 609319 833873
Blocks:
  Show dependency treegraph
 
Reported: 2009-03-03 13:11 EST by Vincent Danen
Modified: 2012-11-29 10:14 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-11-29 10:14:23 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
patch from the Debian BTS that proposes a fix for this issue (953 bytes, patch)
2009-03-03 13:17 EST, Vincent Danen
no flags Details | Diff

  None (edit)
Description Vincent Danen 2009-03-03 13:11:52 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0758 to
the following vulnerability:

Name: CVE-2009-0758
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0758
Assigned: 20090303
Reference: MLIST:[oss-security] 20090302 CVE id request: avahi
Reference: URL: http://www.openwall.com/lists/oss-security/2009/03/02/1
Reference: MISC: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517683

The originates_from_local_legacy_unicast_socket function in
avahi-core/server.c in avahi-daemon 0.6.23 does not account for the
network byte order of a port number when processing incoming multicast
packets, which allows remote attackers to cause a denial of service
(network bandwidth and CPU consumption) via a crafted legacy unicast
mDNS query packet that triggers a multicast packet storm.
Comment 2 Vincent Danen 2009-03-03 13:17:09 EST
Created attachment 333906 [details]
patch from the Debian BTS that proposes a fix for this issue
Comment 4 Lennart Poettering 2009-03-18 13:20:27 EDT
This is really really low priority since the reflection feature is not enabled by default and has always been documented as being experimental and that it might crucify your network.

Not sure if this should really be considered a security issue at all. Of course, this should be fixed, but all this CVE bureaucracy is way over-the-top if you ask me. I'll apply a fix for this into the Avahi sources, but I am not really convinced that I should do a full new release just for this.
Comment 5 Lennart Poettering 2009-03-18 13:20:50 EDT
fix this in the upstream Avahi sources, that is.
Comment 6 Vincent Danen 2009-03-18 13:33:33 EDT
Where is it noted as being experimental?

Looking at the avahi-daemon.conf manpage, the only warning about enabling the reflector is to make sure that you don't have multiple reflectors, and only the reflect-ipv keyword is noted as being not recommended.

I see it's not default, which is fine, but I'd like to know where it is indicated that enabling it is not recommended or where it's noted as being experimental.

If you feel that real-world use of the reflector functionality would be more or less non-existent, then I'd agree with dropping the severity and either dropping or deferring this issue.
Comment 7 Lennart Poettering 2009-03-18 13:44:58 EDT
Uh, indeed. I never actually mentioned that in the man pages. Sorry for the confusion. I guess I should fix that as well.

I am pretty sure though that I mentioned that a couple of times on the MLs and on IRC. 

Anyway, I'd still say that this is a rather exotic feature not worth all the hubbub. The man page even says is "it should work", so I guess you could read from that that I was not even sure it really was that reliable back when I wrote it.

Yes, this needs to be fixed, and yes I should have better documented that it is mostly an experimental feature.
Comment 8 Vincent Danen 2009-03-18 13:58:40 EDT
Ok, thanks for that.  What we will do then is defer this and fix it in any future update we have for avahi for RHEL5.  When you fix this upstream (and roll a new version), updating Fedora to the new version may not be a bad idea, and getting it into rawhide would be great.
Comment 9 Tomas Hoger 2009-03-19 04:26:22 EDT
(In reply to comment #5)
> fix this in the upstream Avahi sources, that is.  

Just for the future reference - have you used Debian patch in upstream sources?  The change is not yet visible at: http://avahi.org/browser/
Comment 10 Lennart Poettering 2009-03-19 07:08:38 EDT
No, I haven't fixed this upstream yet. Sorry. But from a first glance the Debian fix looks about right.
Comment 11 Lennart Poettering 2009-03-31 19:46:38 EDT
This is fixed upstream now:

http://git.0pointer.de/?p=avahi.git;a=commit;h=6fabf9d5189cf0efb86af1cd57e5399f8e31112a
Comment 12 Vincent Danen 2009-12-04 17:45:38 EST
This is corrected in upstream 0.6.25; Fedora 11 and 12 have this version and are fixed.
Comment 13 Tomas Hoger 2010-06-25 03:15:41 EDT
Re-open, waiting to get included in some future RHEL5 avahi update (see comment
#8).
Comment 15 Lennart Poettering 2010-06-29 21:25:22 EDT
commited and built for rhel 5.5.z and rhel 5.6 now.

nvr are as follows:

rhel5.5.z: avahi-0.6.16-9.el5.5

rhel5.6: avahi-0.6.16-9.el5
Comment 17 Tomas Hoger 2010-07-12 11:58:08 EDT
(In reply to comment #4)
> This is really really low priority since the reflection feature is not enabled
> by default and has always been documented as being experimental and that it
> might crucify your network.

For future reference - relevant avahi-daemon.conf option to enable / disable reflector is enable-reflector.  Defaults to "no".
Comment 18 errata-xmlrpc 2010-07-13 13:49:53 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0528 https://rhn.redhat.com/errata/RHSA-2010-0528.html
Comment 19 Vincent Danen 2010-07-13 14:00:56 EDT
Statement:

(none)

Note You need to log in before you can comment on or make changes to this bug.