Bug 667187 (CVE-2011-0634, CVE-2011-1002) - CVE-2011-1002 avahi: daemon infinite loop triggered by an empty UDP packet (CVE-2010-2244 fix regression)
Summary: CVE-2011-1002 avahi: daemon infinite loop triggered by an empty UDP packet (C...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-0634, CVE-2011-1002
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 679861 684884 684885 684886 833874
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-01-04 18:56 UTC by nuh
Modified: 2019-09-29 12:42 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-05-19 13:33:13 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0436 normal SHIPPED_LIVE Moderate: avahi security update 2011-04-12 18:09:25 UTC
Red Hat Product Errata RHSA-2011:0779 normal SHIPPED_LIVE Moderate: avahi security and bug fix update 2011-05-19 11:09:43 UTC

Description nuh 2011-01-04 18:56:33 UTC
Description of problem:

If a NULL UDP packet is sent to the avahi port 5353 it triggers and infinite loop with all the expected goodies, 100% CPU usage and DOS of avahi. This is due to the fix for bug 607297 ( https://bugzilla.redhat.com/show_bug.cgi?id=607297 ). You can re-open that bug and fix it with something that clears the null message from the socket before going to fail or you can keep this as a separate bug.

Version-Release number of selected component (if applicable):

all versions of avahi >0.6.24

Steps to Reproduce:
Send a null UDP packet to avahi on port 5353. I personally use Scapy but anything will work.

  
Actual results:
Infinite loop.

Expected results:
Packet discarded. 

Additional info:
In avahi_recv_dns_packet_ipv4 the bug fix: if (!ms) goto fail; Doesn't clear out a Null message from the socket before returning. This is reason for the infinite loop.

Comment 1 nuh 2011-01-04 19:49:13 UTC
I have added this bug as a ticket to the avahi tracking system, #325.
http://avahi.org/ticket/325

Comment 2 Lennart Poettering 2011-02-18 22:52:37 UTC
This has been fixed upstream now.

Comment 3 Josh Bressers 2011-02-22 18:23:45 UTC
MITRE is calling CVE-2011-0634 a dupe of CVE-2011-1002.

Comment 4 nuh 2011-02-22 18:49:03 UTC
CVE-2011-0634 was a candidate for this issue first but never added as an alias for this bug. Someone applied for CVE-2011-1002 recently and added it as an alias for the bug so I added the original CVE-2011-0634. I was going to release a test tool with a full-disc for this bug using CVE-2011-0634 but I wanted it patched first. I apologize for the confusion, in the future I will add the CVE right away.

Comment 5 Jan Lieskovsky 2011-02-23 16:44:10 UTC
Moving this bug to Security Response product, to properly track the issue.

Comment 6 Jan Lieskovsky 2011-02-23 16:47:03 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1002 to
the following vulnerability:

avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows
remote attackers to cause a denial of service (infinite loop) via an
empty (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this
vulnerability exists because of an incorrect fix for CVE-2010-2244.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1002
[2] http://openwall.com/lists/oss-security/2011/02/18/1
[3] http://openwall.com/lists/oss-security/2011/02/18/4
[4] http://avahi.org/ticket/325
[5] http://git.0pointer.de/?p=avahi.git;a=commit;h=46109dfec75534fe270c0ab902576f685d5ab3a6
[6] http://www.securityfocus.com/bid/46446
[7] http://secunia.com/advisories/43361

Comment 7 Jan Lieskovsky 2011-02-23 16:48:49 UTC
As noted above, the CVE-2011-0634 identifier has been rejected with the
following explanation:

Name: CVE-2011-0634
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0634 [Open URL]
Final-Decision:
Interim-Decision:
Modified:
Proposed:
Assigned: 20110120
Category:

** REJECT **

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-1002. Reason:
This candidate is a reservation duplicate of CVE-2011-1002. Notes:
All CVE users should reference CVE-2011-1002 instead of this
candidate. All references and descriptions in this candidate have
been removed to prevent accidental usage.

Comment 8 Jan Lieskovsky 2011-02-23 17:48:33 UTC
This issue affects the versions of the avahi package, as shipped
with Red Hat Enterprise Linux 5 and 6.

--

This issue affects the versions of the avahi package, as shipped
with Fedora release of 13 and 14.

Please schedule an update.

Comment 9 Jan Lieskovsky 2011-02-23 17:49:29 UTC
Created avahi tracking bugs for this issue

Affects: fedora-all [bug 679861]

Comment 10 Vincent Danen 2011-03-04 22:24:37 UTC
Because avahi is used for local network broadcast messages (local network service discovery), it should be AV:A, not AV:N.  It also is low impact, not moderate impact, as a result.

Comment 11 Tomas Hoger 2011-03-14 17:29:35 UTC
I'm going to keep this at impact=moderate to have a consistent rating with what was used for CVE-2010-2244, even though it's borderline issue.  The fix is to be included in the already planned avahi updated in 6.1.

Comment 13 Tomas Hoger 2011-03-14 17:45:13 UTC
Upstream git commit, noted for future reference:
http://git.0pointer.de/?p=avahi.git;a=commitdiff;h=46109dfec75534fe270c0ab902576f685d5ab3a6

Comment 18 errata-xmlrpc 2011-04-12 18:09:33 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:0436 https://rhn.redhat.com/errata/RHSA-2011-0436.html

Comment 19 errata-xmlrpc 2011-05-19 11:09:53 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0779 https://rhn.redhat.com/errata/RHSA-2011-0779.html

Comment 20 errata-xmlrpc 2011-05-19 14:28:30 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0779 https://rhn.redhat.com/errata/RHSA-2011-0779.html


Note You need to log in before you can comment on or make changes to this bug.