Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 14 Dec 2008 11:32:26 +0100
From: Tomas Hoger <thoger@...hat.com>
To: OSS Security <oss-security@...ts.openwall.com>
Cc: hdias@...chlabs.com
Subject: Avahi daemon DoS (CVE-2008-5081)

Hi!

New avahi upstream release 0.6.24 was released on Friday.
  http://avahi.org/milestone/Avahi%200.6.24

Security issue mentioned in the DoS flaw reported by Hugo Dias.
Crafted mDNS packet with source port 0 can cause avahi-daemon to
abort() due to failed assertion assert(port > 0); in
originates_from_local_legacy_unicast_socket() function in
avahi-core/server.c.

Upstream commit:
http://git.0pointer.de/?p=avahi.git;a=commitdiff;h=3093047f1aa36bed8a37fa79004bf0ee287929f4

CVE CVE-2008-5081 was assigned to this issue.

-- 
Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.