Bug 245586 (CVE-2007-3372) - CVE-2007-3372 avahi: assert fail local DoS via D-Bus
Summary: CVE-2007-3372 avahi: assert fail local DoS via D-Bus
Alias: CVE-2007-3372
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://avahi.org/milestone/Avahi%200....
Depends On: 476496
TreeView+ depends on / blocked
Reported: 2007-06-25 15:52 UTC by Red Hat Product Security
Modified: 2021-11-12 19:41 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2009-01-08 17:07:23 UTC

Attachments (Terms of Use)
Patch used by Ubuntu in USN-696 (1.22 KB, patch)
2009-01-08 09:27 UTC, Tomas Hoger
no flags Details | Diff

Description Lubomir Kundrak 2007-06-25 15:52:20 UTC
Description of problem:

Avahi 0.6.20 was issued fixing a local Denial of Service flaw, where a local
attacker could crash Avahi daemon by sending a crafted message via D-Bus.

Comment 2 Tomas Hoger 2008-12-19 08:27:46 UTC
Upstream fix:

Comment 5 Tomas Hoger 2009-01-08 08:51:14 UTC
Original report with PoC:

Comment 7 Tomas Hoger 2009-01-08 09:27:50 UTC
Created attachment 328453 [details]
Patch used by Ubuntu in USN-696


Comment 8 Tomas Hoger 2009-01-08 09:30:56 UTC
Looks like the issue may have been introduced in 0.6.17 via following commit:

Older versions use dbus_message_iter_get_array_len() and set k to "" when empty array is received.

Comment 9 Tomas Hoger 2009-01-08 17:07:23 UTC
Confirmed with upstream that this issue was indeed introduced in 0.6.17, as is now noted on the upstream security page:

avahi version shipped in Red Hat Enterprise Linux 5 is 0.6.16 and was not affected by this flaw.  All current Fedora versions ship post-0.6.20 version and therefore have the fix included.

Comment 10 Red Hat Bugzilla 2009-10-23 19:05:43 UTC
Reporter changed to security-response-team by request of Jay Turner.

Note You need to log in before you can comment on or make changes to this bug.