Description
The consume_labels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | avahi | 0.6.16-1 | — |
| Debian 13 | avahi | 0.6.16-1 | — |
| Debian 12 | avahi | 0.6.16-1 | — |
References
- 23673 third-party-advisory
- MDKSA-2007:003 vendor-advisory
- http://www.avahi.org/#December2006
- ADV-2007-0071 vdb-entry
- 23644 third-party-advisory
- SUSE-SR:2007:007 vendor-advisory
- http://www.avahi.org/ticket/84
- FEDORA-2007-018 vendor-advisory
- 23660 third-party-advisory
- 24995 third-party-advisory
- http://www.avahi.org/changeset/1340
- FEDORA-2007-019 vendor-advisory
- 23628 third-party-advisory
- 23782 third-party-advisory
- USN-402-1 vendor-advisory
- 21881 vdb-entry