Security World: [SECURITY] [DSA 1690-1] New avahi packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1690-1 security@debian.org
http://www.debian.org/security/ Florian Weimer
December 22, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : avahi
Vulnerability : assert errors
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2007-3372 CVE-2008-5081
Debian Bug : 508700

Two denial of service conditions were discovered in avahi, a Multicast
DNS implementation.

Huge Dias discovered that the avahi daemon aborts with an assert error
if it encounters a UDP packet with source port 0 (CVE-2008-5081).

It was discovered that the avahi daemon aborts with an assert error if
it receives an empty TXT record over D-Bus (CVE-2007-3372).

For the stable distribution (etch), these problems have been fixed in
version 0.6.16-3etch2.

For the unstable distribution (sid), these problems have been fixed in
version 0.6.23-3.

We recommend that you upgrade your avahi packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

http://security.debian.org/pool/updates/main/a/avahi/avahi_0.6.16-3etch2.dsc
Size/MD5 checksum: 1570 8ebff455c9264d5dbee95ab9577378e5
http://security.debian.org/pool/updates/main/a/avahi/avahi_0.6.16.orig.tar.gz
Size/MD5 checksum: 891970 3cbc460bbd55bae35f7b57443c063640
http://security.debian.org/pool/updates/main/a/avahi/avahi_0.6.16-3etch2.diff.gz
Size/MD5 checksum: 19735 a44b3f5fec53e6316da43c6a3b442e8c

Architecture independent packages:

http://security.debian.org/pool/updates/main/a/avahi/avahi-discover_0.6.16-3etch2_all.deb
Size/MD5 checksum: 25370 340795bc9ca2e64e801fddaac6d7a8bf
http://security.debian.org/pool/updates/main/a/avahi/python-avahi_0.6.16-3etch2_all.deb
Size/MD5 checksum: 25652 d6cf860ba2a5f8a098976473782c2a83

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJJTzhSAAoJEL97/wQC1SS+aecH/382jMvurE73swrfBe1COnRV
bbyIiU44e/2kxY8nhnh/R2s2xkXi/p9v2ltLexUInLKoiVttnxMET7cohlZ+XaQy
TehYp3sFphu642elBB5n1kc/+tn3sFvkfwtg6zmD+S29rGx1p7/MQGEZIW8liXPg
oF62I723s5tjYoiItcXMbsjpmSptW0VhtdTZP6ceBWeOheb1JloVs5QNw5V2xbE4
E5JW/8G8tjzqqC3Hy3OyYlg1eFIpJcIg/Jjzdml/rEVANknI2xR70KsmpjOmf3hS
vu8yzMuEIGx/f11TcVobxKz5mplwgeXevc7N6coXCA78DVmREJPGSKv/NkFjOrw=
=BEqG
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Search This Blog

Sunday, December 21, 2008

[SECURITY] [DSA 1690-1] New avahi packages fix denial of service

No comments: