Bug 667187 - (CVE-2011-0634, CVE-2011-1002) CVE-2011-1002 avahi: daemon infinite loop triggered by an empty UDP packet (CVE-2010-2244 fix regression)
CVE-2011-1002 avahi: daemon infinite loop triggered by an empty UDP packet (C...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
public=20110104,reported=20110218,sou...
: Security
Depends On: 679861 684884 684885 684886 833874
Blocks:
  Show dependency treegraph
 
Reported: 2011-01-04 13:56 EST by nuh
Modified: 2016-03-04 06:43 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-05-19 09:33:13 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description nuh 2011-01-04 13:56:33 EST
Description of problem:

If a NULL UDP packet is sent to the avahi port 5353 it triggers and infinite loop with all the expected goodies, 100% CPU usage and DOS of avahi. This is due to the fix for bug 607297 ( https://bugzilla.redhat.com/show_bug.cgi?id=607297 ). You can re-open that bug and fix it with something that clears the null message from the socket before going to fail or you can keep this as a separate bug.

Version-Release number of selected component (if applicable):

all versions of avahi >0.6.24

Steps to Reproduce:
Send a null UDP packet to avahi on port 5353. I personally use Scapy but anything will work.

  
Actual results:
Infinite loop.

Expected results:
Packet discarded. 

Additional info:
In avahi_recv_dns_packet_ipv4 the bug fix: if (!ms) goto fail; Doesn't clear out a Null message from the socket before returning. This is reason for the infinite loop.
Comment 1 nuh 2011-01-04 14:49:13 EST
I have added this bug as a ticket to the avahi tracking system, #325.
http://avahi.org/ticket/325
Comment 2 Lennart Poettering 2011-02-18 17:52:37 EST
This has been fixed upstream now.
Comment 3 Josh Bressers 2011-02-22 13:23:45 EST
MITRE is calling CVE-2011-0634 a dupe of CVE-2011-1002.
Comment 4 nuh 2011-02-22 13:49:03 EST
CVE-2011-0634 was a candidate for this issue first but never added as an alias for this bug. Someone applied for CVE-2011-1002 recently and added it as an alias for the bug so I added the original CVE-2011-0634. I was going to release a test tool with a full-disc for this bug using CVE-2011-0634 but I wanted it patched first. I apologize for the confusion, in the future I will add the CVE right away.
Comment 5 Jan Lieskovsky 2011-02-23 11:44:10 EST
Moving this bug to Security Response product, to properly track the issue.
Comment 6 Jan Lieskovsky 2011-02-23 11:47:03 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1002 to
the following vulnerability:

avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows
remote attackers to cause a denial of service (infinite loop) via an
empty (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this
vulnerability exists because of an incorrect fix for CVE-2010-2244.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002
[2] http://openwall.com/lists/oss-security/2011/02/18/1
[3] http://openwall.com/lists/oss-security/2011/02/18/4
[4] http://avahi.org/ticket/325
[5] http://git.0pointer.de/?p=avahi.git;a=commit;h=46109dfec75534fe270c0ab902576f685d5ab3a6
[6] http://www.securityfocus.com/bid/46446
[7] http://secunia.com/advisories/43361
Comment 7 Jan Lieskovsky 2011-02-23 11:48:49 EST
As noted above, the CVE-2011-0634 identifier has been rejected with the
following explanation:

Name: CVE-2011-0634
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0634 [Open URL]
Final-Decision:
Interim-Decision:
Modified:
Proposed:
Assigned: 20110120
Category:

** REJECT **

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-1002. Reason:
This candidate is a reservation duplicate of CVE-2011-1002. Notes:
All CVE users should reference CVE-2011-1002 instead of this
candidate. All references and descriptions in this candidate have
been removed to prevent accidental usage.
Comment 8 Jan Lieskovsky 2011-02-23 12:48:33 EST
This issue affects the versions of the avahi package, as shipped
with Red Hat Enterprise Linux 5 and 6.

--

This issue affects the versions of the avahi package, as shipped
with Fedora release of 13 and 14.

Please schedule an update.
Comment 9 Jan Lieskovsky 2011-02-23 12:49:29 EST
Created avahi tracking bugs for this issue

Affects: fedora-all [bug 679861]
Comment 10 Vincent Danen 2011-03-04 17:24:37 EST
Because avahi is used for local network broadcast messages (local network service discovery), it should be AV:A, not AV:N.  It also is low impact, not moderate impact, as a result.
Comment 11 Tomas Hoger 2011-03-14 13:29:35 EDT
I'm going to keep this at impact=moderate to have a consistent rating with what was used for CVE-2010-2244, even though it's borderline issue.  The fix is to be included in the already planned avahi updated in 6.1.
Comment 13 Tomas Hoger 2011-03-14 13:45:13 EDT
Upstream git commit, noted for future reference:
http://git.0pointer.de/?p=avahi.git;a=commitdiff;h=46109dfec75534fe270c0ab902576f685d5ab3a6
Comment 18 errata-xmlrpc 2011-04-12 14:09:33 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:0436 https://rhn.redhat.com/errata/RHSA-2011-0436.html
Comment 19 errata-xmlrpc 2011-05-19 07:09:53 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0779 https://rhn.redhat.com/errata/RHSA-2011-0779.html
Comment 20 errata-xmlrpc 2011-05-19 10:28:30 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0779 https://rhn.redhat.com/errata/RHSA-2011-0779.html

Note You need to log in before you can comment on or make changes to this bug.