CVE-2021-3502

A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.

A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.

A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers.

Security Fix(es):

• avahi: Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket (CVE-2021-3468)
• avahi: reachable assertion in avahi_s_host_name_resolver_start when trying to resolve badly-formatted hostnames (CVE-2021-3502)
• avahi: avahi-daemon can be crashed via DBus (CVE-2023-1981)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2021-3468: handle termination event on avahi Unix socket to prevent infinite loop
• CVE-2023-1981: prevent avahi daemon crash by emitting an error if the requested D-Bus service is not found
• CVE-2021-3502: fix avahi-daemon crashing from NULL pointer assertions
• CVE-2023-38469: reject overly long TXT resource records to prevent reachable assertion in avahi_dns_packet_append_record
• CVE-2023-38470: ensure each label is at least one byte long in avahi_normalize_name() to prevent reachable assertion in avahi_escape_label()
• CVE-2023-38471: fix creating invalid escape sequence in dbus_set_host_name function
• CVE-2023-38472: ensure avahi_rdata_parse() has valid rdata before parsing to prevent reachable assertion
• CVE-2023-38473: normalize input in avahi_alternative_host_name() to prevent reachable assertion due to unescaped dot handling

A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability (CVE-2021-3502).

These are all security issues fixed in the avahi-0.8-7.2 package on the GA media of openSUSE Tumbleweed.

Thomas Kremer discovered that Avahi incorrectly handled termination signals on the Unix socket. A local attacker could possibly use this issue to cause Avahi to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-3468)

It was discovered that Avahi incorrectly handled certain hostnames. A local attacker could possibly use this issue to cause Avahi to crash, resulting in a denial of service. This issue only affected Ubuntu 20.10 and Ubuntu 21.04. (CVE-2021-3502)