Package: avahi-daemon; Maintainer for avahi-daemon is Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>; Source for avahi-daemon is src:avahi (PTS, buildd, popcon).
Reported by: Alexander Kurtz <kurtz.alex@googlemail.com>
Date: Wed, 23 Feb 2011 12:39:01 UTC
Severity: critical
Tags: security
Found in versions avahi/0.6.27-2, avahi/0.6.23-3lenny2
Fixed in versions avahi/0.6.28-4, avahi/0.6.27-2+squeeze1, avahi/0.6.23-3lenny3
Done: Michael Biebl <biebl@debian.org>
Bug is archived. No further changes may be made.
View this report as an mbox folder, status mbox, maintainer mbox
Report forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>:
Bug#614785; Package avahi-daemon.
(Wed, 23 Feb 2011 12:39:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Alexander Kurtz <kurtz.alex@googlemail.com>:
New Bug report received and forwarded. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Wed, 23 Feb 2011 12:39:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Package: avahi-daemon Version: 0.6.27-2 Tags: security Severity: critical Justification: Introduces possible denial-of-service scenario. Hi, when I scan my server from another machine on the network using nmap, I get this: # nmap -sU -p5353 192.168.2.2 Starting Nmap 5.00 ( http://nmap.org ) at 2011-02-23 13:15 CET Interesting ports on 192.168.2.2: PORT STATE SERVICE 5353/udp open|filtered zeroconf MAC Address: XX:XX:XX:XX:XX:XX (Netgear) Nmap done: 1 IP address (1 host up) scanned in 0.50 seconds # As soon as the scan starts, avahi-daemon on the server starts running amok, top shows this: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 5535 avahi 20 0 33884 1600 1280 R 100 0.0 2:28.47 avahi-daemon Restarting avahi-daemon is not possible: # /etc/init.d/avahi-daemon restart Restarting Avahi mDNS/DNS-SD Daemon: avahi-daemonFailed to kill daemon: Timer expired . # Simply terminating the process doesn't work either: # ps -Af | grep avahi-daemon avahi 5535 1 87 13:14 ? 00:04:43 avahi-daemon: running [server.local] avahi 5536 5535 0 13:14 ? 00:00:00 avahi-daemon: chroot helper root 5610 5581 0 13:20 pts/2 00:00:00 grep avahi-daemon # kill 5535 # ps -Af | grep avahi-daemon avahi 5535 1 88 13:14 ? 00:05:02 avahi-daemon: running [server.local] avahi 5536 5535 0 13:14 ? 00:00:00 avahi-daemon: chroot helper root 5614 5581 0 13:20 pts/2 00:00:00 grep avahi-daemon # Forcibly killing the process works: # kill -9 5535 # ps -Af | grep avahi-daemon root 5629 5581 0 13:23 pts/2 00:00:00 grep avahi-daemon # I don't know what kind of data nmap sends when scanning for open UDP ports, but it definitely shouldn't cause avahi-daemon to run amok. Please note that I have not changed the Avahi configuration in any way, so you should be able to reproduce this easily. Please tell me if you need any more information! Best regards Alexander Kurtz
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>:
Bug#614785; Package avahi-daemon.
(Wed, 23 Feb 2011 13:00:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Michael Biebl <biebl@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Wed, 23 Feb 2011 13:00:03 GMT) (full text, mbox, link).
Message #10 received at 614785@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Am 23.02.2011 13:36, schrieb Alexander Kurtz: > Package: avahi-daemon > Version: 0.6.27-2 > Tags: security > Severity: critical > Justification: Introduces possible denial-of-service scenario. > > Hi, > > when I scan my server from another machine on the network using nmap, I > get this: > > # nmap -sU -p5353 192.168.2.2 > > Starting Nmap 5.00 ( http://nmap.org ) at 2011-02-23 13:15 CET > Interesting ports on 192.168.2.2: > PORT STATE SERVICE > 5353/udp open|filtered zeroconf > MAC Address: XX:XX:XX:XX:XX:XX (Netgear) > > Nmap done: 1 IP address (1 host up) scanned in 0.50 seconds > # > > As soon as the scan starts, avahi-daemon on the server starts running > amok, top shows this: > > PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND > 5535 avahi 20 0 33884 1600 1280 R 100 0.0 2:28.47 avahi-daemon > > Restarting avahi-daemon is not possible: > > # /etc/init.d/avahi-daemon restart > Restarting Avahi mDNS/DNS-SD Daemon: avahi-daemonFailed to kill daemon: Timer expired > . > # > > Simply terminating the process doesn't work either: > > # ps -Af | grep avahi-daemon > avahi 5535 1 87 13:14 ? 00:04:43 avahi-daemon: running [server.local] > avahi 5536 5535 0 13:14 ? 00:00:00 avahi-daemon: chroot helper > root 5610 5581 0 13:20 pts/2 00:00:00 grep avahi-daemon > # kill 5535 > # ps -Af | grep avahi-daemon > avahi 5535 1 88 13:14 ? 00:05:02 avahi-daemon: running [server.local] > avahi 5536 5535 0 13:14 ? 00:00:00 avahi-daemon: chroot helper > root 5614 5581 0 13:20 pts/2 00:00:00 grep avahi-daemon > # > > Forcibly killing the process works: > > # kill -9 5535 > # ps -Af | grep avahi-daemon > root 5629 5581 0 13:23 pts/2 00:00:00 grep avahi-daemon > # > > I don't know what kind of data nmap sends when scanning for open UDP > ports, but it definitely shouldn't cause avahi-daemon to run amok. > > Please note that I have not changed the Avahi configuration in any way, > so you should be able to reproduce this easily. Please tell me if you > need any more information! I was able to reproduce this problem on a squeeze system, but not on unstable. Can you confirm that? Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?
[signature.asc (application/pgp-signature, attachment)]
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>:
Bug#614785; Package avahi-daemon.
(Wed, 23 Feb 2011 13:27:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Alexander Kurtz <kurtz.alex@googlemail.com>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Wed, 23 Feb 2011 13:27:03 GMT) (full text, mbox, link).
Message #15 received at 614785@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Am Mittwoch, den 23.02.2011, 13:58 +0100 schrieb Michael Biebl: > I was able to reproduce this problem on a squeeze system, but not on unstable. > > Can you confirm that? Negative, I tried upgrading avahi-daemon and libavahi-* to the sid versions (0.6.28-3) but the problem is still there. However, I haven't tried a complete upgrade to sid, so the problem may very well be in some third-party package which is fixed in sid. Best regards Alexander Kurtz
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>:
Bug#614785; Package avahi-daemon.
(Wed, 23 Feb 2011 14:00:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Michael Biebl <biebl@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Wed, 23 Feb 2011 14:00:03 GMT) (full text, mbox, link).
Message #20 received at 614785@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Am 23.02.2011 14:23, schrieb Alexander Kurtz: > Am Mittwoch, den 23.02.2011, 13:58 +0100 schrieb Michael Biebl: >> I was able to reproduce this problem on a squeeze system, but not on unstable. >> >> Can you confirm that? > > Negative, I tried upgrading avahi-daemon and libavahi-* to the sid > versions (0.6.28-3) but the problem is still there. > > However, I haven't tried a complete upgrade to sid, so the problem may > very well be in some third-party package which is fixed in sid. As it turns out, this issue is already known: http://avahi.org/ticket/325 https://bugzilla.redhat.com/show_bug.cgi?id=607297 https://bugzilla.redhat.com/show_bug.cgi?id=667187 CVE-2011-1002 The fix is available at http://git.0pointer.de/?p=avahi.git;a=commit;h=46109dfec75534fe270c0ab902576f685d5ab3a6 I could successfully verify that this patch fixes the problem I could reproduce. Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?
[signature.asc (application/pgp-signature, attachment)]
Reply sent
to Michael Biebl <biebl@debian.org>:
You have taken responsibility.
(Wed, 23 Feb 2011 15:03:11 GMT) (full text, mbox, link).
Notification sent
to Alexander Kurtz <kurtz.alex@googlemail.com>:
Bug acknowledged by developer.
(Wed, 23 Feb 2011 15:03:11 GMT) (full text, mbox, link).
Message #25 received at 614785-close@bugs.debian.org (full text, mbox, reply):
Source: avahi Source-Version: 0.6.28-4 We believe that the bug you reported is fixed in the latest version of avahi, which is due to be installed in the Debian FTP archive: avahi-autoipd_0.6.28-4_i386.deb to main/a/avahi/avahi-autoipd_0.6.28-4_i386.deb avahi-daemon_0.6.28-4_i386.deb to main/a/avahi/avahi-daemon_0.6.28-4_i386.deb avahi-dbg_0.6.28-4_i386.deb to main/a/avahi/avahi-dbg_0.6.28-4_i386.deb avahi-discover_0.6.28-4_all.deb to main/a/avahi/avahi-discover_0.6.28-4_all.deb avahi-dnsconfd_0.6.28-4_i386.deb to main/a/avahi/avahi-dnsconfd_0.6.28-4_i386.deb avahi-ui-utils_0.6.28-4_i386.deb to main/a/avahi/avahi-ui-utils_0.6.28-4_i386.deb avahi-utils_0.6.28-4_i386.deb to main/a/avahi/avahi-utils_0.6.28-4_i386.deb avahi_0.6.28-4.debian.tar.gz to main/a/avahi/avahi_0.6.28-4.debian.tar.gz avahi_0.6.28-4.dsc to main/a/avahi/avahi_0.6.28-4.dsc libavahi-client-dev_0.6.28-4_i386.deb to main/a/avahi/libavahi-client-dev_0.6.28-4_i386.deb libavahi-client3_0.6.28-4_i386.deb to main/a/avahi/libavahi-client3_0.6.28-4_i386.deb libavahi-common-data_0.6.28-4_i386.deb to main/a/avahi/libavahi-common-data_0.6.28-4_i386.deb libavahi-common-dev_0.6.28-4_i386.deb to main/a/avahi/libavahi-common-dev_0.6.28-4_i386.deb libavahi-common3_0.6.28-4_i386.deb to main/a/avahi/libavahi-common3_0.6.28-4_i386.deb libavahi-compat-libdnssd-dev_0.6.28-4_i386.deb to main/a/avahi/libavahi-compat-libdnssd-dev_0.6.28-4_i386.deb libavahi-compat-libdnssd1_0.6.28-4_i386.deb to main/a/avahi/libavahi-compat-libdnssd1_0.6.28-4_i386.deb libavahi-core-dev_0.6.28-4_i386.deb to main/a/avahi/libavahi-core-dev_0.6.28-4_i386.deb libavahi-core7_0.6.28-4_i386.deb to main/a/avahi/libavahi-core7_0.6.28-4_i386.deb libavahi-glib-dev_0.6.28-4_i386.deb to main/a/avahi/libavahi-glib-dev_0.6.28-4_i386.deb libavahi-glib1_0.6.28-4_i386.deb to main/a/avahi/libavahi-glib1_0.6.28-4_i386.deb libavahi-gobject-dev_0.6.28-4_i386.deb to main/a/avahi/libavahi-gobject-dev_0.6.28-4_i386.deb libavahi-gobject0_0.6.28-4_i386.deb to main/a/avahi/libavahi-gobject0_0.6.28-4_i386.deb libavahi-qt3-1_0.6.28-4_i386.deb to main/a/avahi/libavahi-qt3-1_0.6.28-4_i386.deb libavahi-qt3-dev_0.6.28-4_i386.deb to main/a/avahi/libavahi-qt3-dev_0.6.28-4_i386.deb libavahi-qt4-1_0.6.28-4_i386.deb to main/a/avahi/libavahi-qt4-1_0.6.28-4_i386.deb libavahi-qt4-dev_0.6.28-4_i386.deb to main/a/avahi/libavahi-qt4-dev_0.6.28-4_i386.deb libavahi-ui-dev_0.6.28-4_i386.deb to main/a/avahi/libavahi-ui-dev_0.6.28-4_i386.deb libavahi-ui0_0.6.28-4_i386.deb to main/a/avahi/libavahi-ui0_0.6.28-4_i386.deb python-avahi_0.6.28-4_all.deb to main/a/avahi/python-avahi_0.6.28-4_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 614785@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Michael Biebl <biebl@debian.org> (supplier of updated avahi package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 23 Feb 2011 15:34:21 +0100 Source: avahi Binary: avahi-daemon avahi-dnsconfd avahi-autoipd python-avahi avahi-utils avahi-discover libavahi-common3 libavahi-common-data libavahi-common-dev libavahi-core7 libavahi-core-dev libavahi-client3 libavahi-client-dev libavahi-glib1 libavahi-glib-dev libavahi-gobject0 libavahi-gobject-dev libavahi-qt3-1 libavahi-qt3-dev libavahi-qt4-1 libavahi-qt4-dev libavahi-compat-libdnssd1 libavahi-compat-libdnssd-dev libavahi-ui0 libavahi-ui-dev avahi-ui-utils avahi-dbg Architecture: source i386 all Version: 0.6.28-4 Distribution: unstable Urgency: high Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org> Changed-By: Michael Biebl <biebl@debian.org> Description: avahi-autoipd - Avahi IPv4LL network address configuration daemon avahi-daemon - Avahi mDNS/DNS-SD daemon avahi-dbg - Avahi - debugging symbols avahi-discover - Service discover user interface for avahi avahi-dnsconfd - Avahi DNS configuration tool avahi-ui-utils - Avahi GTK+ utilities avahi-utils - Avahi browsing, publishing and discovery utilities libavahi-client-dev - Development files for the Avahi client library libavahi-client3 - Avahi client library libavahi-common-data - Avahi common data files libavahi-common-dev - Development files for the Avahi common library libavahi-common3 - Avahi common library libavahi-compat-libdnssd-dev - Development headers for the Avahi Apple Bonjour compatibility lib libavahi-compat-libdnssd1 - Avahi Apple Bonjour compatibility library libavahi-core-dev - Development files for Avahi's embeddable mDNS/DNS-SD library libavahi-core7 - Avahi's embeddable mDNS/DNS-SD library libavahi-glib-dev - Development headers for the Avahi glib integration library libavahi-glib1 - Avahi glib integration library libavahi-gobject-dev - Development headers for the Avahi GObject library libavahi-gobject0 - Avahi GObject library libavahi-qt3-1 - Avahi Qt 3 integration library libavahi-qt3-dev - Development headers for the Avahi Qt 3 integration library libavahi-qt4-1 - Avahi Qt 4 integration library libavahi-qt4-dev - Development headers for the Avahi Qt 4 integration library libavahi-ui-dev - Development headers for the Avahi GTK+ User interface library libavahi-ui0 - Avahi GTK+ User interface library python-avahi - Python utility package for Avahi Closes: 614785 Changes: avahi (0.6.28-4) unstable; urgency=high . * Bump debhelper compatibility level to 8 and update build dependency on debhelper accordingly. * debian/patches/03_read_null_udp_packets.patch - Read NULL UDP packets else we end up in an infinite loop using 100% CPU and DoS of Avahi. (Closes: #614785, Fixes: CVE-2011-1002) * Urgency high for the security fix. Checksums-Sha1: d4ec91c5f3484cf008450f3f2b80cf8c98cd1cdc 2800 avahi_0.6.28-4.dsc 5f9c6dccdb7f01a9e6d59125c9bb6386b78b694d 33822 avahi_0.6.28-4.debian.tar.gz 69767a9b0c51c8ed181981b0b4499702bcd06bf7 92406 avahi-daemon_0.6.28-4_i386.deb 8cb96d62e903574fe84b36d511e7314ce3f4dd9b 42054 avahi-dnsconfd_0.6.28-4_i386.deb 674dd27ba622ca09e10073d98a0e31c720a880b5 51944 avahi-autoipd_0.6.28-4_i386.deb a6def82e89d6c1256ce4ed6360b5f627c29dab77 35770 python-avahi_0.6.28-4_all.deb 60f891afb2942a1996b0f56e026a999f15587099 53978 avahi-utils_0.6.28-4_i386.deb 699356146f0723321e1e30c49c5cff71a19f505f 37848 avahi-discover_0.6.28-4_all.deb 83c6a1b44d763835274df3333c11a2e5ddff57cd 51304 libavahi-common3_0.6.28-4_i386.deb a1ba6d91feee78b6ac49a463594f8fc5bd395321 134224 libavahi-common-data_0.6.28-4_i386.deb 4f490e2035772009831e8469f03eadf9fdf8e41c 68028 libavahi-common-dev_0.6.28-4_i386.deb 4f7033aa4d4ac3021f01a4cf537cdf58ffc55924 118920 libavahi-core7_0.6.28-4_i386.deb 666e9215ed82ca9cc0601a86d5a3241a1fbaa75d 143486 libavahi-core-dev_0.6.28-4_i386.deb 79c6ac724df882324530f18e958e5f6cc1b9bc33 55126 libavahi-client3_0.6.28-4_i386.deb 2e87f581b07a14a0eb5b62781e4a68553d79af5f 61700 libavahi-client-dev_0.6.28-4_i386.deb e6305f67d58689e6af6aaba5aa241370b84a1807 35522 libavahi-glib1_0.6.28-4_i386.deb a5115f1e98b10cc0d1f442f2e947c56f650d107e 35696 libavahi-glib-dev_0.6.28-4_i386.deb 608c9daa49e127b8d1cff9721e09a28b5a4b5ad7 45458 libavahi-gobject0_0.6.28-4_i386.deb 6c8402e8971f677b74bd76e06aa72d11a9b3abda 50234 libavahi-gobject-dev_0.6.28-4_i386.deb 79d152157f74a59108cde79948672b13f9835484 37180 libavahi-qt3-1_0.6.28-4_i386.deb b67af0fdad8ee688b3eff69fa6f9fd6bca1f32a5 37680 libavahi-qt3-dev_0.6.28-4_i386.deb b0cf12c1b60d2665cdc44c1334a2e64bbafbf954 35630 libavahi-qt4-1_0.6.28-4_i386.deb 3b17a3b0d3223df116b8b5d13d0bdb1fd60e376e 35700 libavahi-qt4-dev_0.6.28-4_i386.deb 2a8a01f3b60feaf6ca136ff39df1b06caedce5d5 44358 libavahi-compat-libdnssd1_0.6.28-4_i386.deb 96362c0e570bddc16bdab6c2c433494600e2d283 62538 libavahi-compat-libdnssd-dev_0.6.28-4_i386.deb 734c5742c46a2169eea4f8b81e29844260ef8244 49302 libavahi-ui0_0.6.28-4_i386.deb a00f1e94b3c193f0b71bffd6bb23b8fe9917a3de 48510 libavahi-ui-dev_0.6.28-4_i386.deb 46aaf097d6d89150ac5c61d74c1474c2f6758b51 38696 avahi-ui-utils_0.6.28-4_i386.deb 5efa4ef10bea399ed35618ff243f6e8506c3f149 622772 avahi-dbg_0.6.28-4_i386.deb Checksums-Sha256: 45cd9700994d97202cd6305c74c38547f20d62239334246ae1bef78875ba5c07 2800 avahi_0.6.28-4.dsc a9cbad691a22b0a15e10fdc3ae65c5b22d08acc23ed9df129ec58d7017d3b3e6 33822 avahi_0.6.28-4.debian.tar.gz 899bed044099585c229f1de81f8263c4777687d3753ca41a957e8d32297b7d26 92406 avahi-daemon_0.6.28-4_i386.deb 151aff7069902fe229c521a851a035453ca0b7d70115933f75583ffeea6b2810 42054 avahi-dnsconfd_0.6.28-4_i386.deb 5563dc4498903464c666bf5cde33e2171626ec809456bcbdcefb1bcec7215f5b 51944 avahi-autoipd_0.6.28-4_i386.deb 054c51ae631724525ee05d810bbb9743314e7021f8a1119afbfbbc5d1467650d 35770 python-avahi_0.6.28-4_all.deb 61b6ee6021d2748ba083da255e45d449551d8567656de7f1ce007b6ff56967d8 53978 avahi-utils_0.6.28-4_i386.deb 2afea381547720bba11fb6070dfa0fc040eeea9d4b39917a200e8ae89b48f56d 37848 avahi-discover_0.6.28-4_all.deb 2d526b2e0cde420545641e07a0ac83db6c0180f81ca42cff6271a02047bce99e 51304 libavahi-common3_0.6.28-4_i386.deb b7bd91609651fb43b0d2454898c47423a30a5a66f82862e2cfdd442214a43c09 134224 libavahi-common-data_0.6.28-4_i386.deb 1401c455bdc6ac158c9b06129c58d39f31fd5cdbe9a76478dd0bb212e40a5dc4 68028 libavahi-common-dev_0.6.28-4_i386.deb b7538fb87a5d58176b32e2286fdc284e1af4ddc5f8434cc80fe8a13a06a73e4c 118920 libavahi-core7_0.6.28-4_i386.deb a703030d1d888843bd5ba147ef0a0498ab0b5a55821a2da08101a7d3ab83a3ff 143486 libavahi-core-dev_0.6.28-4_i386.deb aa9062a77deb25cb87b33326551f20489f9ccad7587e3cecde72b7d84e9ed1af 55126 libavahi-client3_0.6.28-4_i386.deb 72ae8a2e8c5cab10f42fce08a66b1e7f2fd47478e6376464c96531ee43a88b57 61700 libavahi-client-dev_0.6.28-4_i386.deb b5f1d7e670504d51264a657800fee172b4b8cfdec478de0c70cce7fef95a4ac0 35522 libavahi-glib1_0.6.28-4_i386.deb d07b36a1d6768b2556cd2a070589b612d2357e499b794d28d9308200108cf85f 35696 libavahi-glib-dev_0.6.28-4_i386.deb 3807d7e4864ea4d08cc83fedb9e856280b5731b4850194062fe23f3d37747bfb 45458 libavahi-gobject0_0.6.28-4_i386.deb 22807cf22047cc4698386785730054b1ba96365a4723268ff61d87bdea457531 50234 libavahi-gobject-dev_0.6.28-4_i386.deb 1cabad8142b07bbaaa12f838331e1f1840534e00db1ec4160f5ea7ec88e3b2b7 37180 libavahi-qt3-1_0.6.28-4_i386.deb 01b0cc9617fac422a50cdcb1db2dd4af4c11cd3fdc10f07658ace0a08d67821a 37680 libavahi-qt3-dev_0.6.28-4_i386.deb 2ce050b67046bdb3bb2137f483298be0be6513aff1bec1b23687bf650ca0a73f 35630 libavahi-qt4-1_0.6.28-4_i386.deb e62d22874768dba41f765b5982d4ddf4eaf66493cb19b413e57eabb0b6ace8bc 35700 libavahi-qt4-dev_0.6.28-4_i386.deb 1a59838b0cdd1b564a78134a798e305e4cfb8b57d249df697d9f5f76a50c898e 44358 libavahi-compat-libdnssd1_0.6.28-4_i386.deb 72a6b6cf9d07e6ea83966fd91815e48ae6f6af4eab49ba8bfc3aa57e13fef817 62538 libavahi-compat-libdnssd-dev_0.6.28-4_i386.deb 78d82585b99f01fe8b4312bd9ed506947caa1b85fda3bd8a788c22626f459da2 49302 libavahi-ui0_0.6.28-4_i386.deb 9682eac0f0e25b73a40e69d526559657b23d72811153d7b64e59b372c023ca0b 48510 libavahi-ui-dev_0.6.28-4_i386.deb 6594e5d98c8b7510062d2975e19cfb1d9651bd65d8f0279dbe4ecbffa03e4f88 38696 avahi-ui-utils_0.6.28-4_i386.deb 84dfc6cdbeacf31b526e11e2466ba836cbd9201f71ad7e26a16e47451664bae7 622772 avahi-dbg_0.6.28-4_i386.deb Files: 3430cb5d178db20c9847d4ffa1dbd6a5 2800 net optional avahi_0.6.28-4.dsc 1a61329f942b39353b4249c5e6574dfb 33822 net optional avahi_0.6.28-4.debian.tar.gz b85074d8e279807f1024c3e67022ab53 92406 net optional avahi-daemon_0.6.28-4_i386.deb ad25ea34c50a875195ca9e6bc3af0d97 42054 net optional avahi-dnsconfd_0.6.28-4_i386.deb f625945a4f72602e31d37815f113dfaf 51944 net optional avahi-autoipd_0.6.28-4_i386.deb b67cf51f9d990938b3455c4b0835e916 35770 python optional python-avahi_0.6.28-4_all.deb 655e15b793574bcb29c8f88ddbd61d94 53978 net optional avahi-utils_0.6.28-4_i386.deb b5a7150d83cce221e1cd00ed6264528f 37848 net optional avahi-discover_0.6.28-4_all.deb cada6355f526ffe00482059e27d83df1 51304 libs optional libavahi-common3_0.6.28-4_i386.deb 31db06cebe5e524dfeef0651244dfe57 134224 libs optional libavahi-common-data_0.6.28-4_i386.deb 70be3c09b51324abac3cbbeee447ca73 68028 libdevel optional libavahi-common-dev_0.6.28-4_i386.deb c4e880fe65751439e28330845756b0ac 118920 libs optional libavahi-core7_0.6.28-4_i386.deb 22df53ba1a5e3dcbc51851cd4d16b3cf 143486 libdevel optional libavahi-core-dev_0.6.28-4_i386.deb 609d572e0513b0228aa47ed89deda2f7 55126 libs optional libavahi-client3_0.6.28-4_i386.deb f45934c440d4e44cd1b0dc8433bfbb84 61700 libdevel optional libavahi-client-dev_0.6.28-4_i386.deb 4bf4107e096f1c2c5f0b54a6f3a7c113 35522 libs optional libavahi-glib1_0.6.28-4_i386.deb ad2a1eb145f4c18c88ecf46106def9c7 35696 libdevel optional libavahi-glib-dev_0.6.28-4_i386.deb 42633b58e53f9e6f83e4fda451ef2dc2 45458 libs optional libavahi-gobject0_0.6.28-4_i386.deb 691c909d6a00601fb70cb5379e936996 50234 libdevel optional libavahi-gobject-dev_0.6.28-4_i386.deb 0e1c484feadc46df998834e850173344 37180 libs optional libavahi-qt3-1_0.6.28-4_i386.deb d9f1c04c2858be6fc95b7170117902ff 37680 libdevel optional libavahi-qt3-dev_0.6.28-4_i386.deb f073af055cf6a80e766f640464971b09 35630 libs optional libavahi-qt4-1_0.6.28-4_i386.deb 194f39ed3f14244c6c46f246ef42f5d1 35700 libdevel optional libavahi-qt4-dev_0.6.28-4_i386.deb 1b1f313d8478d86c9607491e294262cf 44358 libs optional libavahi-compat-libdnssd1_0.6.28-4_i386.deb 7a701fbe1aa6974f5188b715aaac3076 62538 libdevel optional libavahi-compat-libdnssd-dev_0.6.28-4_i386.deb a691e1f7101ff691aaac312c4ba784e7 49302 libs optional libavahi-ui0_0.6.28-4_i386.deb 08b9dbaccac28b0a52829c7c49ba6f4b 48510 libdevel optional libavahi-ui-dev_0.6.28-4_i386.deb 3ce4b14fee516ba94d765b6561a57eae 38696 utils optional avahi-ui-utils_0.6.28-4_i386.deb ad45ded96a0c6472ca848fc11a53902b 622772 debug extra avahi-dbg_0.6.28-4_i386.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBCAAGBQJNZR2BAAoJEGrh4w1gjyLctOQP/16AyeHrOk7HGAxz2f2l3Sai Y+ifqiUbSq9RH7cu8IE85P1BbFN6Y+svFBUxAfKdRxnPsjQUb9DMSGNMTOrCzr2T JIEEHrL8vCS05lHkKle/Lj6P8GqSJtz7RV6f5MKmkd/96+F+HBm/x6bGF0vfOtTF iunWZ96b427IySpuFdjM8PWPlWP/H2G5G1FD5NyDEcj9pt3abxr/Ybsatql5BL4A PWxlaWBQHPWzPMhPfVjVD6RvD6iVfVfUyRBFHLDrBLudE+IER8Hw/LafsCp378Lo +lJPQ2lyBVj+j9rm8CIi+KNdwcA3WlzAAW+3C4xvMtnjqqxWM9pNcsSTjA4vPsMo nzzdGb8CE1b6kl3F527sP2BGY5FXPBt+cTyy4q8kf2WA7FVdZjCXILP4Gn2Fdwny Sqjtyp//buJJ5ncAjuS2eL4aDxsLFu78kjsfQvi1jlbs8X7hVUz2W+vuPxl7+o2T R0aGGDYes5d/cKf/AP69C6S1UEFQXZwKwTNv0GaUqJDY2d17GI4OaYJc3Gd4DdEg bxWmSDfibnSMsf9nutSacy7aqFfMuHacQOuHrVqrDFC/6cj2li+lRMzFs6ax3tSP 1AqZqEEFu8a/vloSAHmw4KJ/KiGVz5sMOPrtRN4fCwiaioJDUCrMYT9Z9msR/ixo vOCmhu1Z9+d+acTHUwt9 =Za6P -----END PGP SIGNATURE-----
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>:
Bug#614785; Package avahi-daemon.
(Wed, 23 Feb 2011 15:15:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Michael Biebl <biebl@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Wed, 23 Feb 2011 15:15:04 GMT) (full text, mbox, link).
Message #30 received at 614785@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Am 23.02.2011 14:56, schrieb Michael Biebl: > Am 23.02.2011 14:23, schrieb Alexander Kurtz: >> Am Mittwoch, den 23.02.2011, 13:58 +0100 schrieb Michael Biebl: >>> I was able to reproduce this problem on a squeeze system, but not on unstable. >>> >>> Can you confirm that? >> >> Negative, I tried upgrading avahi-daemon and libavahi-* to the sid >> versions (0.6.28-3) but the problem is still there. >> >> However, I haven't tried a complete upgrade to sid, so the problem may >> very well be in some third-party package which is fixed in sid. > > As it turns out, this issue is already known: > > http://avahi.org/ticket/325 > https://bugzilla.redhat.com/show_bug.cgi?id=607297 > https://bugzilla.redhat.com/show_bug.cgi?id=667187 > CVE-2011-1002 > > The fix is available at > http://git.0pointer.de/?p=avahi.git;a=commit;h=46109dfec75534fe270c0ab902576f685d5ab3a6 > > I could successfully verify that this patch fixes the problem I could reproduce. A fixed package has been uploaded to unstable and stable-security (squeeze). Thanks for the bug report. Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?
[signature.asc (application/pgp-signature, attachment)]
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>:
Bug#614785; Package avahi-daemon.
(Thu, 24 Feb 2011 12:37:44 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Thu, 24 Feb 2011 12:37:44 GMT) (full text, mbox, link).
Message #35 received at 614785@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
found 614785 0.6.23-3lenny2 thanks Hi! I can reproduce this too on lenny, can someone confirm that? Up to date lenny system with avahi-daemon 0.6.23-3lenny2. Bests Salvatore
[signature.asc (application/pgp-signature, inline)]
Bug Marked as found in versions avahi/0.6.23-3lenny2.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Thu, 24 Feb 2011 12:37:46 GMT) (full text, mbox, link).
Message sent on
to Alexander Kurtz <kurtz.alex@googlemail.com>:
Bug#614785.
(Thu, 24 Feb 2011 12:37:51 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>:
Bug#614785; Package avahi-daemon.
(Thu, 24 Feb 2011 14:54:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Alexander Kurtz <kurtz.alex@googlemail.com>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Thu, 24 Feb 2011 14:54:03 GMT) (full text, mbox, link).
Message #45 received at 614785@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Hi everybody, Am Mittwoch, den 23.02.2011, 16:13 +0100 schrieb Michael Biebl: > A fixed package has been uploaded to unstable and stable-security (squeeze). First the good news: I can confirm that upgrading *all* avahi packages to 0.6.28-4 fixes the problem (only upgrading avahi-daemon does not!). Am Donnerstag, den 24.02.2011, 13:27 +0100 schrieb Salvatore Bonaccorso: > I can reproduce this too on lenny, can someone confirm that? Up to > date lenny system with avahi-daemon 0.6.23-3lenny2. Now the bad news: The Debian security tracker[1] says: [lenny] - avahi <not-affected> (Vulnerable code not present, introduced in 0.6.25) That's wrong: Looking at the source code reveals this: $ cat avahi-0.6.23/debian/patches/15_CVE-2010-2244.patch --- a/avahi-core/socket.c +++ avahi-0.6.23/avahi-core/socket.c @@ -652,6 +652,10 @@ AvahiDnsPacket *avahi_recv_dns_packet_ipv4( goto fail; } + /* corrupt packets have zero size */ + if (!ms) + goto fail; + p = avahi_dns_packet_new(ms + AVAHI_DNS_PACKET_EXTRA_SIZE); io.iov_base = AVAHI_DNS_PACKET_DATA(p); @@ -805,6 +809,10 @@ AvahiDnsPacket *avahi_recv_dns_packet_ipv6( goto fail; } + /* corrupt packets have zero size */ + if (!ms) + goto fail; + p = avahi_dns_packet_new(ms + AVAHI_DNS_PACKET_EXTRA_SIZE); io.iov_base = AVAHI_DNS_PACKET_DATA(p); $ So, the code which introduced this vulnerability (CVE-2011-1002[1]) was actually added[2] when fixing another vulnerability (CVE-2010-2244[3]). As a consequence, lenny IS indeed vulnerable and needs to be fixed too. Best regards and thank you very much for your work! Alexander Kurtz [1] http://security-tracker.debian.org/tracker/CVE-2011-1002 [2] http://packages.qa.debian.org/a/avahi/news/20100805T140231Z.html [3] http://security-tracker.debian.org/tracker/CVE-2010-2244
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>:
Bug#614785; Package avahi-daemon.
(Thu, 24 Feb 2011 14:57:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Michael Biebl <biebl@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Thu, 24 Feb 2011 14:57:03 GMT) (full text, mbox, link).
Message #50 received at 614785@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Am 24.02.2011 15:48, schrieb Alexander Kurtz: > So, the code which introduced this vulnerability (CVE-2011-1002[1]) was > actually added[2] when fixing another vulnerability (CVE-2010-2244[3]). > As a consequence, lenny IS indeed vulnerable and needs to be fixed too. Correct. I uploaded a fixed lenny package to oldstable-security 30min ago. Cheers, Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?
[signature.asc (application/pgp-signature, attachment)]
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>:
Bug#614785; Package avahi-daemon.
(Thu, 24 Feb 2011 15:00:06 GMT) (full text, mbox, link).
Acknowledgement sent
to Michael Biebl <biebl@debian.org>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Thu, 24 Feb 2011 15:00:07 GMT) (full text, mbox, link).
Message #55 received at 614785@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Am 24.02.2011 15:52, schrieb Michael Biebl: > Am 24.02.2011 15:48, schrieb Alexander Kurtz: >> So, the code which introduced this vulnerability (CVE-2011-1002[1]) was >> actually added[2] when fixing another vulnerability (CVE-2010-2244[3]). >> As a consequence, lenny IS indeed vulnerable and needs to be fixed too. > > Correct. > > I uploaded a fixed lenny package to oldstable-security 30min ago. But you are right, the security tracker should be updated -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?
[signature.asc (application/pgp-signature, attachment)]
Information forwarded
to debian-bugs-dist@lists.debian.org, Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>:
Bug#614785; Package avahi-daemon.
(Thu, 24 Feb 2011 23:33:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Alexander Kurtz <kurtz.alex@googlemail.com>:
Extra info received and forwarded to list. Copy sent to Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>.
(Thu, 24 Feb 2011 23:33:04 GMT) (full text, mbox, link).
Message #60 received at 614785@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Am Donnerstag, den 24.02.2011, 15:57 +0100 schrieb Michael Biebl: > But you are right, the security tracker should be updated http://svn.debian.org/wsvn/secure-testing/?rev=16247 Best regards Alexander Kurtz
[signature.asc (application/pgp-signature, inline)]
Reply sent
to Michael Biebl <biebl@debian.org>:
You have taken responsibility.
(Sat, 26 Feb 2011 19:57:03 GMT) (full text, mbox, link).
Notification sent
to Alexander Kurtz <kurtz.alex@googlemail.com>:
Bug acknowledged by developer.
(Sat, 26 Feb 2011 19:57:03 GMT) (full text, mbox, link).
Message #65 received at 614785-close@bugs.debian.org (full text, mbox, reply):
Source: avahi Source-Version: 0.6.27-2+squeeze1 We believe that the bug you reported is fixed in the latest version of avahi, which is due to be installed in the Debian FTP archive: avahi-autoipd_0.6.27-2+squeeze1_i386.deb to main/a/avahi/avahi-autoipd_0.6.27-2+squeeze1_i386.deb avahi-daemon_0.6.27-2+squeeze1_i386.deb to main/a/avahi/avahi-daemon_0.6.27-2+squeeze1_i386.deb avahi-dbg_0.6.27-2+squeeze1_i386.deb to main/a/avahi/avahi-dbg_0.6.27-2+squeeze1_i386.deb avahi-discover_0.6.27-2+squeeze1_all.deb to main/a/avahi/avahi-discover_0.6.27-2+squeeze1_all.deb avahi-dnsconfd_0.6.27-2+squeeze1_i386.deb to main/a/avahi/avahi-dnsconfd_0.6.27-2+squeeze1_i386.deb avahi-ui-utils_0.6.27-2+squeeze1_i386.deb to main/a/avahi/avahi-ui-utils_0.6.27-2+squeeze1_i386.deb avahi-utils_0.6.27-2+squeeze1_i386.deb to main/a/avahi/avahi-utils_0.6.27-2+squeeze1_i386.deb avahi_0.6.27-2+squeeze1.debian.tar.gz to main/a/avahi/avahi_0.6.27-2+squeeze1.debian.tar.gz avahi_0.6.27-2+squeeze1.dsc to main/a/avahi/avahi_0.6.27-2+squeeze1.dsc libavahi-client-dev_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-client-dev_0.6.27-2+squeeze1_i386.deb libavahi-client3_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-client3_0.6.27-2+squeeze1_i386.deb libavahi-common-data_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-common-data_0.6.27-2+squeeze1_i386.deb libavahi-common-dev_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-common-dev_0.6.27-2+squeeze1_i386.deb libavahi-common3_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-common3_0.6.27-2+squeeze1_i386.deb libavahi-compat-libdnssd-dev_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-compat-libdnssd-dev_0.6.27-2+squeeze1_i386.deb libavahi-compat-libdnssd1_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-compat-libdnssd1_0.6.27-2+squeeze1_i386.deb libavahi-core-dev_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-core-dev_0.6.27-2+squeeze1_i386.deb libavahi-core7_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-core7_0.6.27-2+squeeze1_i386.deb libavahi-glib-dev_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-glib-dev_0.6.27-2+squeeze1_i386.deb libavahi-glib1_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-glib1_0.6.27-2+squeeze1_i386.deb libavahi-gobject-dev_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-gobject-dev_0.6.27-2+squeeze1_i386.deb libavahi-gobject0_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-gobject0_0.6.27-2+squeeze1_i386.deb libavahi-qt3-1_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-qt3-1_0.6.27-2+squeeze1_i386.deb libavahi-qt3-dev_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-qt3-dev_0.6.27-2+squeeze1_i386.deb libavahi-qt4-1_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-qt4-1_0.6.27-2+squeeze1_i386.deb libavahi-qt4-dev_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-qt4-dev_0.6.27-2+squeeze1_i386.deb libavahi-ui-dev_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-ui-dev_0.6.27-2+squeeze1_i386.deb libavahi-ui0_0.6.27-2+squeeze1_i386.deb to main/a/avahi/libavahi-ui0_0.6.27-2+squeeze1_i386.deb python-avahi_0.6.27-2+squeeze1_all.deb to main/a/avahi/python-avahi_0.6.27-2+squeeze1_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 614785@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Michael Biebl <biebl@debian.org> (supplier of updated avahi package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 23 Feb 2011 15:59:15 +0100 Source: avahi Binary: avahi-daemon avahi-dnsconfd avahi-autoipd python-avahi avahi-utils avahi-discover libavahi-common3 libavahi-common-data libavahi-common-dev libavahi-core7 libavahi-core-dev libavahi-client3 libavahi-client-dev libavahi-glib1 libavahi-glib-dev libavahi-gobject0 libavahi-gobject-dev libavahi-qt3-1 libavahi-qt3-dev libavahi-qt4-1 libavahi-qt4-dev libavahi-compat-libdnssd1 libavahi-compat-libdnssd-dev libavahi-ui0 libavahi-ui-dev avahi-ui-utils avahi-dbg Architecture: source all i386 Version: 0.6.27-2+squeeze1 Distribution: stable-security Urgency: high Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org> Changed-By: Michael Biebl <biebl@debian.org> Description: avahi-autoipd - Avahi IPv4LL network address configuration daemon avahi-daemon - Avahi mDNS/DNS-SD daemon avahi-dbg - Avahi - debugging symbols avahi-discover - Service discover user interface for avahi avahi-dnsconfd - Avahi DNS configuration tool avahi-ui-utils - Avahi GTK+ utilities avahi-utils - Avahi browsing, publishing and discovery utilities libavahi-client-dev - Development files for the Avahi client library libavahi-client3 - Avahi client library libavahi-common-data - Avahi common data files libavahi-common-dev - Development files for the Avahi common library libavahi-common3 - Avahi common library libavahi-compat-libdnssd-dev - Development headers for the Avahi Apple Bonjour compatibility lib libavahi-compat-libdnssd1 - Avahi Apple Bonjour compatibility library libavahi-core-dev - Development files for Avahi's embeddable mDNS/DNS-SD library libavahi-core7 - Avahi's embeddable mDNS/DNS-SD library libavahi-glib-dev - Development headers for the Avahi glib integration library libavahi-glib1 - Avahi glib integration library libavahi-gobject-dev - Development headers for the Avahi GObject library libavahi-gobject0 - Avahi GObject library libavahi-qt3-1 - Avahi Qt 3 integration library libavahi-qt3-dev - Development headers for the Avahi Qt 3 integration library libavahi-qt4-1 - Avahi Qt 4 integration library libavahi-qt4-dev - Development headers for the Avahi Qt 4 integration library libavahi-ui-dev - Development headers for the Avahi GTK+ User interface library libavahi-ui0 - Avahi GTK+ User interface library python-avahi - Python utility package for Avahi Closes: 614785 Changes: avahi (0.6.27-2+squeeze1) stable-security; urgency=high . * debian/patches/03_read_null_udp_packets.patch - Read NULL UDP packets else we end up in an infinite loop using 100% CPU and DoS of Avahi. (Closes: #614785, Fixes: CVE-2011-1002) * Urgency high for the security fix. Checksums-Sha1: de14b4078d689ccd3211555eb6879e6cc00e3e11 2872 avahi_0.6.27-2+squeeze1.dsc e763bbeba92fd5b3ba3e2af5fc85aaf99b406c8b 1217974 avahi_0.6.27.orig.tar.gz 705ead050db3d73ad69bafee6c5caeceff0b30b2 34969 avahi_0.6.27-2+squeeze1.debian.tar.gz 01a380b5cac9a045e1e034c36471db5e80e529a7 35186 python-avahi_0.6.27-2+squeeze1_all.deb 858a2a5cc6ea5a4b546d7b1f1b4fab262ddca8f1 36918 avahi-discover_0.6.27-2+squeeze1_all.deb b50bd5af116e3b0854ea1cdf956fe14b6bdb7984 91318 avahi-daemon_0.6.27-2+squeeze1_i386.deb 53707d9d02cd14358b66c46d68391e5e76a97c02 41550 avahi-dnsconfd_0.6.27-2+squeeze1_i386.deb 829421686a354fa888d4f0cc3bfdfa2414f86f08 51428 avahi-autoipd_0.6.27-2+squeeze1_i386.deb 4deea4c4e8ba6299cf41ca7870f8740ab11cb00e 53410 avahi-utils_0.6.27-2+squeeze1_i386.deb b50119b199fa196cfe8b75896be27ca75d988253 50776 libavahi-common3_0.6.27-2+squeeze1_i386.deb ff38196ec6932dab39b78827ec64d3ad6858a97c 112252 libavahi-common-data_0.6.27-2+squeeze1_i386.deb 80226a1c80c1082b9224b8cdb4671dbbf863f665 67398 libavahi-common-dev_0.6.27-2+squeeze1_i386.deb bcc5a0767755b71b668271b0bf974cf1df427cb2 118410 libavahi-core7_0.6.27-2+squeeze1_i386.deb ac4cf61f7a3796c8cc72229b0ac43fbadca493c4 143566 libavahi-core-dev_0.6.27-2+squeeze1_i386.deb 91e053e0d6011a29ca2014ff23ae57176b58eef3 54670 libavahi-client3_0.6.27-2+squeeze1_i386.deb 19425523e6d2fdc248990867c809e4507516cbf8 61176 libavahi-client-dev_0.6.27-2+squeeze1_i386.deb 2088fb1e2c0f796916f266a14c8fcc384dc16840 34962 libavahi-glib1_0.6.27-2+squeeze1_i386.deb 2b9ab3c0b0ade9f4c1445888db745ef51169148e 35690 libavahi-glib-dev_0.6.27-2+squeeze1_i386.deb 901a1136b0747bca60163b1b7fc4bf6446552cfe 44942 libavahi-gobject0_0.6.27-2+squeeze1_i386.deb f98361bd031942460de7f1129e03ce9690c691b4 49686 libavahi-gobject-dev_0.6.27-2+squeeze1_i386.deb d997d4af607042a724999c5c771dbda467af213b 36632 libavahi-qt3-1_0.6.27-2+squeeze1_i386.deb 5c7be5256eb0860fb79e417a6f30aa3951bcf923 37154 libavahi-qt3-dev_0.6.27-2+squeeze1_i386.deb 24089d0ca6ad559eff89a5861691ce23a40a9898 35014 libavahi-qt4-1_0.6.27-2+squeeze1_i386.deb 878d9620dc013ce9f9b1cd160f85ad7a38de3331 35698 libavahi-qt4-dev_0.6.27-2+squeeze1_i386.deb 87d18179873a7db3036ace1e25add0d73512e2c8 43826 libavahi-compat-libdnssd1_0.6.27-2+squeeze1_i386.deb ee0ac299c4410be1931db24403ffd74b7e920b97 62404 libavahi-compat-libdnssd-dev_0.6.27-2+squeeze1_i386.deb 6fd3cffe2caa8530bea580ffe2c2ac46f396573f 48804 libavahi-ui0_0.6.27-2+squeeze1_i386.deb 1e5b6a6e5054155baf3743622e9dd10fbe4b9fce 48494 libavahi-ui-dev_0.6.27-2+squeeze1_i386.deb cd91989b2dccc97a53631ab0a425144515c49336 37816 avahi-ui-utils_0.6.27-2+squeeze1_i386.deb e31fa96da5d6d4ab3edd62df44f6d22515fb3c51 623018 avahi-dbg_0.6.27-2+squeeze1_i386.deb Checksums-Sha256: e10e8111fbd60a9e590a481154febd5baf5e4ec5296a423072790d71eb15699b 2872 avahi_0.6.27-2+squeeze1.dsc c22df5e0b0d695bfe3cc52545bf0affc1c52060818a5a65d70055e320bc45e84 1217974 avahi_0.6.27.orig.tar.gz 8a880c27b15119ca1d0d3668b8fa9fb6d943f913be880767381b09050ad514c7 34969 avahi_0.6.27-2+squeeze1.debian.tar.gz eb16baa7cf54f47028b895854b6c56559ddced874a13008a9819cfd5a3300e7f 35186 python-avahi_0.6.27-2+squeeze1_all.deb 4b9a0ea94da81d7ff4d2120198a4fd16c34f0aac441bc6a1205e0cc258c348e5 36918 avahi-discover_0.6.27-2+squeeze1_all.deb 8ef02b6d44d96442be9985059efd00809768b353b64b8894c392de8193cce8b7 91318 avahi-daemon_0.6.27-2+squeeze1_i386.deb 8ed272f4bcda9a97186a938735547c0852e46e0f421a89b8243d7794933b9c42 41550 avahi-dnsconfd_0.6.27-2+squeeze1_i386.deb a9f7b348022eb6958e33782f71fe59fa33215eb59af09f19deb30c2e9280a99c 51428 avahi-autoipd_0.6.27-2+squeeze1_i386.deb d3b54fb3c5316875853d98b3f2592d78a17df6dd32936b5fc0117ccd2d7d0088 53410 avahi-utils_0.6.27-2+squeeze1_i386.deb 50e2c95db851932f3c4a522585ae8d9a13ef1d865e9c9f83267f9da736bb4fa2 50776 libavahi-common3_0.6.27-2+squeeze1_i386.deb 53652ceb138b84408c94d938dd5f89e4fc083e9c56c03d0d91480ab9a5798d9f 112252 libavahi-common-data_0.6.27-2+squeeze1_i386.deb c53c52918045770c7bc688300766031f217e9c5c3eca0c3915a36028547b3e7c 67398 libavahi-common-dev_0.6.27-2+squeeze1_i386.deb 284f4ebfe61764bc603b066a2546076abc0a8e36d1506f0ab1b9a8d23dcf6207 118410 libavahi-core7_0.6.27-2+squeeze1_i386.deb dee15e5cbfe7f95710713a245d1b4cc72235e74c955b9477d9fcdaab662613a8 143566 libavahi-core-dev_0.6.27-2+squeeze1_i386.deb 64a9270205bbce126afacd2911971df867cbf72735c46b610878fad410dd47c5 54670 libavahi-client3_0.6.27-2+squeeze1_i386.deb 96824d325d6506f6ea11fca734717f78293eac729b15ebf81a0dad40bf824874 61176 libavahi-client-dev_0.6.27-2+squeeze1_i386.deb 4b5df4b962c79ef5ec0540ede586cf4ce8ea5ba3f828073bedb4e5da13f525f2 34962 libavahi-glib1_0.6.27-2+squeeze1_i386.deb 4a59959993c0b49da2385907936e825a7e6654b7dbf669be271fcf0d793145b6 35690 libavahi-glib-dev_0.6.27-2+squeeze1_i386.deb 4d4e765c41a713615305ab5caa64c334db443c6e0d8b99eb0a5670b2659aee3b 44942 libavahi-gobject0_0.6.27-2+squeeze1_i386.deb e3ab06697a6d791d947f760437142fb4d0c2667365a1ba90ce055791ffd1253d 49686 libavahi-gobject-dev_0.6.27-2+squeeze1_i386.deb 38672f9b4fc406a47d4cadcecf52a358a6bdf09ceb1002ee3436f241f4ee7b12 36632 libavahi-qt3-1_0.6.27-2+squeeze1_i386.deb fc4ba8794e7ab8e07f1ba604c8ec4b4505ae0abadea45a3a85ae7da675c9e93e 37154 libavahi-qt3-dev_0.6.27-2+squeeze1_i386.deb 640017b34e9a060e17469e56900217b7102c39fc914472322ab2ecc953b05ec5 35014 libavahi-qt4-1_0.6.27-2+squeeze1_i386.deb b02a6559625f40ea7c590b537d8e68a24d48ce96675291a4315c47ad80282546 35698 libavahi-qt4-dev_0.6.27-2+squeeze1_i386.deb 2542665fb7b37c8cd5945583a853b9484831887ebb14671a9a3bebf47b4fe4da 43826 libavahi-compat-libdnssd1_0.6.27-2+squeeze1_i386.deb b386a2c6f49c1eac594f054d51b6058e0b87e427839625803ef1b31c608c4084 62404 libavahi-compat-libdnssd-dev_0.6.27-2+squeeze1_i386.deb c2415219391f4cfcad992e73200e0c043c066ac3f6eac7ac96dab51535349d9d 48804 libavahi-ui0_0.6.27-2+squeeze1_i386.deb 0196ff6ac36913cddcda6cd9fec3b28c1f28ed3a4974bc97c057d684ca77b529 48494 libavahi-ui-dev_0.6.27-2+squeeze1_i386.deb 26b1da1fc574529e1ed116a84ff38c7bd7337226da351bb28daafcc3ea2d50b5 37816 avahi-ui-utils_0.6.27-2+squeeze1_i386.deb 293009feba259151eb80120271d2d1dcc42150ecdc9c8174610792c13ad6820d 623018 avahi-dbg_0.6.27-2+squeeze1_i386.deb Files: 45d376f3839b84a8b2fc50a09c868dd5 2872 net optional avahi_0.6.27-2+squeeze1.dsc 74b40f87aeab07fc77af25f725b32f04 1217974 net optional avahi_0.6.27.orig.tar.gz cc2ea8f5747d10d04c1a9cf704b01616 34969 net optional avahi_0.6.27-2+squeeze1.debian.tar.gz 4acec6c6b66744411c09095b10363076 35186 python optional python-avahi_0.6.27-2+squeeze1_all.deb 0cd748d42dad0b40a426684647dc9f7f 36918 net optional avahi-discover_0.6.27-2+squeeze1_all.deb dd31c4260be8012a26acf78aaa7c5adb 91318 net optional avahi-daemon_0.6.27-2+squeeze1_i386.deb 52096042897075e3e43a9cbe6e15f40d 41550 net optional avahi-dnsconfd_0.6.27-2+squeeze1_i386.deb b5208396712c9aa2f3e3f87029d8e9ab 51428 net optional avahi-autoipd_0.6.27-2+squeeze1_i386.deb 203d36cd0e19017cf816ac496c44a79b 53410 net optional avahi-utils_0.6.27-2+squeeze1_i386.deb 5dde3ba70590988b08ffac30beb3d318 50776 libs optional libavahi-common3_0.6.27-2+squeeze1_i386.deb a3064f68633d108deef173d01db2fe5a 112252 libs optional libavahi-common-data_0.6.27-2+squeeze1_i386.deb 5fe43bbf1ef0c18dbec7f7bb3184cb74 67398 libdevel optional libavahi-common-dev_0.6.27-2+squeeze1_i386.deb 7c6e0c850ad795f4e0c4c15ea980df1e 118410 libs optional libavahi-core7_0.6.27-2+squeeze1_i386.deb 7570b27a7dce423ca1b51922a223c2ba 143566 libdevel optional libavahi-core-dev_0.6.27-2+squeeze1_i386.deb 60c8ef5b6f9c01a919e4473a919d6dab 54670 libs optional libavahi-client3_0.6.27-2+squeeze1_i386.deb 8e0cdbd86974d9a8c2d90b38f625ba4b 61176 libdevel optional libavahi-client-dev_0.6.27-2+squeeze1_i386.deb cd935923a9f15d6bb4e68d4d459f834a 34962 libs optional libavahi-glib1_0.6.27-2+squeeze1_i386.deb 0ceeab428f62c1a1f00fbe8105d65948 35690 libdevel optional libavahi-glib-dev_0.6.27-2+squeeze1_i386.deb f6a5d7d92529294ae6539ceb799841a0 44942 libs optional libavahi-gobject0_0.6.27-2+squeeze1_i386.deb 7ae0f2dc5d6915e413f0b8ec8e2f04c1 49686 libdevel optional libavahi-gobject-dev_0.6.27-2+squeeze1_i386.deb 2331800e71030f333a9085c242433875 36632 libs optional libavahi-qt3-1_0.6.27-2+squeeze1_i386.deb cb0a928a34fa1988aa5b2379111a35d9 37154 libdevel optional libavahi-qt3-dev_0.6.27-2+squeeze1_i386.deb f252456b9f06b4c3cd57dd7af28d5c60 35014 libs optional libavahi-qt4-1_0.6.27-2+squeeze1_i386.deb 852a05ed10fcd61706e86d75bb2d3200 35698 libdevel optional libavahi-qt4-dev_0.6.27-2+squeeze1_i386.deb 08802d9d8b1056f79bf691aabf46a4a6 43826 libs optional libavahi-compat-libdnssd1_0.6.27-2+squeeze1_i386.deb c106bdc963d12cde9f0c60bafc8d1db2 62404 libdevel optional libavahi-compat-libdnssd-dev_0.6.27-2+squeeze1_i386.deb f737d862b80a9ad0d35eaa0c1414599c 48804 libs optional libavahi-ui0_0.6.27-2+squeeze1_i386.deb 0d44a4f0621105ec6e984e58d5dd40a4 48494 libdevel optional libavahi-ui-dev_0.6.27-2+squeeze1_i386.deb 9373cc78d905cc8e3616f4dc9998ecda 37816 utils optional avahi-ui-utils_0.6.27-2+squeeze1_i386.deb 910c9ebb62a7e3573a9c983a74fd77ca 623018 debug extra avahi-dbg_0.6.27-2+squeeze1_i386.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBCAAGBQJNZSRQAAoJEGrh4w1gjyLcVRkP/1h4L755oAYc2JtP1HwuGI15 gv33xMz52sGBUYZ5TOhPHWUyIz21Z4YgnChBLWEnm9NgJBmH5kbqd/gMEC2qMjU8 OI6fpYIYJ/86aVeqJpvedAYkueAlJ4qp5MFKmPDgSoyMIl4NrNF+Qxo7ofbfNa+0 FESM16F4iKn7Ir5OqUM0dvR5nfXbxkjOezfnFecs26AimF4Zk74nuJ1kfTtQbDs5 VCyzdlApup80wbo8DAv8pt/4kiO6FXyjenHme5VrHhlZmwfwYKFQ5naCuCKH/nYf pTGkuXLrFpxkmzyDhBodPEDbIVO3FH9HwE2hdiZ/P7kk2TiA1FmHO+kKe+xzdEcG GKjzuby7MQ/ojy87E9gkq6hdVPyMNv9fqOd0GdviykKt/mO2g7s45l5ErJAmIlAl /NQHFexVK099bIp/qMuZ72Nt6Uxz8cIfFnARbtm4ZMLcFxJsImCbPxpG7YjhuIl5 xt0usdhboKZ1RMwa7ipIKuYuIYHsWQ7NZ3s4+OR12W8RNqP/2KDxbwrjdbFTEuXh UtRB3eUCJth57rVwLddNoWaJAOAqeQEaNVaAzZxdqGCL7MxbN+PCiR6U2MNZa29N jKfP72NuZvOR7be1Nn9hbvmGvXYftrHz2s6AHC4MGYXmzjvxIqgWQFPgrp7nGXYw e4SThKqVBPYqExmHsNjE =Cvry -----END PGP SIGNATURE-----
Reply sent
to Michael Biebl <biebl@debian.org>:
You have taken responsibility.
(Thu, 03 Mar 2011 01:57:08 GMT) (full text, mbox, link).
Notification sent
to Alexander Kurtz <kurtz.alex@googlemail.com>:
Bug acknowledged by developer.
(Thu, 03 Mar 2011 01:57:08 GMT) (full text, mbox, link).
Message #70 received at 614785-close@bugs.debian.org (full text, mbox, reply):
Source: avahi Source-Version: 0.6.23-3lenny3 We believe that the bug you reported is fixed in the latest version of avahi, which is due to be installed in the Debian FTP archive: avahi-autoipd_0.6.23-3lenny3_i386.deb to main/a/avahi/avahi-autoipd_0.6.23-3lenny3_i386.deb avahi-daemon_0.6.23-3lenny3_i386.deb to main/a/avahi/avahi-daemon_0.6.23-3lenny3_i386.deb avahi-dbg_0.6.23-3lenny3_i386.deb to main/a/avahi/avahi-dbg_0.6.23-3lenny3_i386.deb avahi-discover_0.6.23-3lenny3_all.deb to main/a/avahi/avahi-discover_0.6.23-3lenny3_all.deb avahi-dnsconfd_0.6.23-3lenny3_i386.deb to main/a/avahi/avahi-dnsconfd_0.6.23-3lenny3_i386.deb avahi-ui-utils_0.6.23-3lenny3_i386.deb to main/a/avahi/avahi-ui-utils_0.6.23-3lenny3_i386.deb avahi-utils_0.6.23-3lenny3_i386.deb to main/a/avahi/avahi-utils_0.6.23-3lenny3_i386.deb avahi_0.6.23-3lenny3.diff.gz to main/a/avahi/avahi_0.6.23-3lenny3.diff.gz avahi_0.6.23-3lenny3.dsc to main/a/avahi/avahi_0.6.23-3lenny3.dsc libavahi-client-dev_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-client-dev_0.6.23-3lenny3_i386.deb libavahi-client3_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-client3_0.6.23-3lenny3_i386.deb libavahi-common-data_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-common-data_0.6.23-3lenny3_i386.deb libavahi-common-dev_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-common-dev_0.6.23-3lenny3_i386.deb libavahi-common3_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-common3_0.6.23-3lenny3_i386.deb libavahi-compat-howl-dev_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-compat-howl-dev_0.6.23-3lenny3_i386.deb libavahi-compat-howl0_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-compat-howl0_0.6.23-3lenny3_i386.deb libavahi-compat-libdnssd-dev_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-compat-libdnssd-dev_0.6.23-3lenny3_i386.deb libavahi-compat-libdnssd1_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-compat-libdnssd1_0.6.23-3lenny3_i386.deb libavahi-core-dev_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-core-dev_0.6.23-3lenny3_i386.deb libavahi-core5_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-core5_0.6.23-3lenny3_i386.deb libavahi-glib-dev_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-glib-dev_0.6.23-3lenny3_i386.deb libavahi-glib1_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-glib1_0.6.23-3lenny3_i386.deb libavahi-gobject-dev_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-gobject-dev_0.6.23-3lenny3_i386.deb libavahi-gobject0_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-gobject0_0.6.23-3lenny3_i386.deb libavahi-qt3-1_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-qt3-1_0.6.23-3lenny3_i386.deb libavahi-qt3-dev_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-qt3-dev_0.6.23-3lenny3_i386.deb libavahi-qt4-1_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-qt4-1_0.6.23-3lenny3_i386.deb libavahi-qt4-dev_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-qt4-dev_0.6.23-3lenny3_i386.deb libavahi-ui-dev_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-ui-dev_0.6.23-3lenny3_i386.deb libavahi-ui0_0.6.23-3lenny3_i386.deb to main/a/avahi/libavahi-ui0_0.6.23-3lenny3_i386.deb python-avahi_0.6.23-3lenny3_all.deb to main/a/avahi/python-avahi_0.6.23-3lenny3_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 614785@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Michael Biebl <biebl@debian.org> (supplier of updated avahi package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Wed, 23 Feb 2011 15:34:21 +0100 Source: avahi Binary: avahi-daemon avahi-dnsconfd avahi-autoipd python-avahi avahi-utils avahi-discover libavahi-common3 libavahi-common-data libavahi-common-dev libavahi-core5 libavahi-core-dev libavahi-client3 libavahi-client-dev libavahi-glib1 libavahi-glib-dev libavahi-gobject0 libavahi-gobject-dev libavahi-qt3-1 libavahi-qt3-dev libavahi-qt4-1 libavahi-qt4-dev libavahi-compat-howl0 libavahi-compat-howl-dev libavahi-compat-libdnssd1 libavahi-compat-libdnssd-dev libavahi-ui0 libavahi-ui-dev avahi-ui-utils avahi-dbg Architecture: source all i386 Version: 0.6.23-3lenny3 Distribution: oldstable-security Urgency: high Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org> Changed-By: Michael Biebl <biebl@debian.org> Description: avahi-autoipd - Avahi IPv4LL network address configuration daemon avahi-daemon - Avahi mDNS/DNS-SD daemon avahi-dbg - Avahi - debugging symbols avahi-discover - Service discover user interface for avahi avahi-dnsconfd - Avahi DNS configuration tool avahi-ui-utils - Avahi GTK+ utilities avahi-utils - Avahi browsing, publishing and discovery utilities libavahi-client-dev - Development files for the Avahi client library libavahi-client3 - Avahi client library libavahi-common-data - Avahi common data files libavahi-common-dev - Development files for the Avahi common library libavahi-common3 - Avahi common library libavahi-compat-howl-dev - Development headers for the Avahi Howl compatibility library libavahi-compat-howl0 - Avahi Howl compatibility library libavahi-compat-libdnssd-dev - Development headers for the Avahi Apple Bonjour compatibility lib libavahi-compat-libdnssd1 - Avahi Apple Bonjour compatibility library libavahi-core-dev - Development files for Avahi's embeddable mDNS/DNS-SD library libavahi-core5 - Avahi's embeddable mDNS/DNS-SD library libavahi-glib-dev - Development headers for the Avahi glib integration library libavahi-glib1 - Avahi glib integration library libavahi-gobject-dev - Development headers for the Avahi GObject library libavahi-gobject0 - Avahi GObject library libavahi-qt3-1 - Avahi Qt 3 integration library libavahi-qt3-dev - Development headers for the Avahi Qt 3 integration library libavahi-qt4-1 - Avahi Qt 4 integration library libavahi-qt4-dev - Development headers for the Avahi Qt 4 integration library libavahi-ui-dev - Development headers for the Avahi GTK+ User interface library libavahi-ui0 - Avahi GTK+ User interface library python-avahi - Python utility package for Avahi Closes: 614785 Changes: avahi (0.6.23-3lenny3) oldstable-security; urgency=high . * debian/patches/17_CVE-2011-1002.patch - Read NULL UDP packets else we end up in an infinite loop using 100% CPU and DoS of Avahi. (Closes: #614785, Fixes: CVE-2011-1002) Checksums-Sha1: 03a9f6757651e587f50d30eb4ce1fd96c435d17b 2959 avahi_0.6.23-3lenny3.dsc dab1446981f67bb1d4c76a5970a25738ce35375d 32733 avahi_0.6.23-3lenny3.diff.gz c016b0bac5f4c4c8b94af50d98b43bcaad7e8e12 29538 python-avahi_0.6.23-3lenny3_all.deb 6b31cfb813ad1b18ea6d5df2530533c825a28a92 36760 avahi-discover_0.6.23-3lenny3_all.deb ea351f0f672b6c7323d270f829bea76c40a4936a 87972 avahi-daemon_0.6.23-3lenny3_i386.deb 0d2037dd572b10e3baae37f08596ec719ec45953 38754 avahi-dnsconfd_0.6.23-3lenny3_i386.deb c1c1dff77c8911408f66683f27a5c42fc3b4931c 48828 avahi-autoipd_0.6.23-3lenny3_i386.deb 6225af7e2e2be3c61e5a3f0ac856a49754a65a34 51194 avahi-utils_0.6.23-3lenny3_i386.deb 91ebc88ea1df5f51d8722dccd01bdb0a2eab9159 48044 libavahi-common3_0.6.23-3lenny3_i386.deb a8ee29b760abed40cad8b55237787415f920288b 31402 libavahi-common-data_0.6.23-3lenny3_i386.deb 0a017712981837beb38eedabf12b986706c9ada5 66814 libavahi-common-dev_0.6.23-3lenny3_i386.deb fa5ebc670b5daa643f9b0f2d1364ddb23ae67c6a 115474 libavahi-core5_0.6.23-3lenny3_i386.deb 4ecfc22bdf99adbe1cf1f5c7041af8d118a7c659 152008 libavahi-core-dev_0.6.23-3lenny3_i386.deb 753015657bef3eb7b4e90ca0f2fbfffb42841b81 52082 libavahi-client3_0.6.23-3lenny3_i386.deb e0e5b053dd3ef64bb87c81789beda90d614df126 61906 libavahi-client-dev_0.6.23-3lenny3_i386.deb 24644c16b60e9733f15f702c53e0bbd9eb4be367 32380 libavahi-glib1_0.6.23-3lenny3_i386.deb 888221220a68dc882f953fb0bc74861687441288 33974 libavahi-glib-dev_0.6.23-3lenny3_i386.deb 2788d6bbb2b12c560db05da4eb00903cc49face5 42254 libavahi-gobject0_0.6.23-3lenny3_i386.deb f76db400b035134d863b025ed31dd0005973592b 49246 libavahi-gobject-dev_0.6.23-3lenny3_i386.deb 0c1bb9f7c923e7d2b456d953bedd315319726792 33818 libavahi-qt3-1_0.6.23-3lenny3_i386.deb 94ac8c53a404acae0a693968b4b1f30352a2cea8 34260 libavahi-qt3-dev_0.6.23-3lenny3_i386.deb 1aaeb4f8cb72ec15cf6c512ca5b32b3ba91d5b82 31896 libavahi-qt4-1_0.6.23-3lenny3_i386.deb 0c47565a32c41d93ea66dcd5fa9144095eee8f8e 32634 libavahi-qt4-dev_0.6.23-3lenny3_i386.deb 74447263596f53caacb818b28bc406cb12bb58b1 47140 libavahi-compat-howl0_0.6.23-3lenny3_i386.deb 83bac2fb08900518d33534e54fdc6dc87d8d8473 60240 libavahi-compat-howl-dev_0.6.23-3lenny3_i386.deb 043e6bc1c8b0d69252e41f31e3242e6b8b7f8946 40748 libavahi-compat-libdnssd1_0.6.23-3lenny3_i386.deb b0a3662471038b499f6bebe85e522b6da9ae5f4c 59774 libavahi-compat-libdnssd-dev_0.6.23-3lenny3_i386.deb cf99791623a0589db882f2f21c17234bf6958684 45862 libavahi-ui0_0.6.23-3lenny3_i386.deb f6103556d253b11302b5f098ff6fd8b2bb784f0f 46958 libavahi-ui-dev_0.6.23-3lenny3_i386.deb 7da9be297401fc1bd89be3b69a2d710c3068224e 33962 avahi-ui-utils_0.6.23-3lenny3_i386.deb 7c35550483d258fcd31e062ed3a7fbc76d02e56b 650148 avahi-dbg_0.6.23-3lenny3_i386.deb Checksums-Sha256: 49ae3ff62412b880fe15c270c820d017a6f707b0824d686778d3e03c99c8e9a3 2959 avahi_0.6.23-3lenny3.dsc aecb57a5d3354439f29f7fa34dfed64f71310c0955bd02e29b700c9792ed1659 32733 avahi_0.6.23-3lenny3.diff.gz a5b7a63dbc244dc3e77936c94b3e6bb8c18729199af1fe2c7830eb76d8c4b625 29538 python-avahi_0.6.23-3lenny3_all.deb cc3afddec16d2bd18679bb4c7abb5cf5d2aaaa8cd3dd47bbda166c773fc5ebf5 36760 avahi-discover_0.6.23-3lenny3_all.deb 0bc853d7201a342c9dc337496c30d4ce304548a7d67dc23b420984c7b89d6682 87972 avahi-daemon_0.6.23-3lenny3_i386.deb a47a6b9492cd036142d45e01d72b87eae9eb1b0ba1566fde037128ee94d85822 38754 avahi-dnsconfd_0.6.23-3lenny3_i386.deb 736209c764ce2312c625023157b17a10433dd34581e489dbdb15773b901457e9 48828 avahi-autoipd_0.6.23-3lenny3_i386.deb 08d479c65f6264fee1252c59588d7dc9bb0cebc1df62c7fc975e78f5e1a83783 51194 avahi-utils_0.6.23-3lenny3_i386.deb 88b36724fc04745d0324e736243d65aba42e62f35fd230cafca11dab3b0656a9 48044 libavahi-common3_0.6.23-3lenny3_i386.deb 973c53d65ca5ee6f6cfcf2b101aef0942c081c19e64e34666400e62ae8e37d67 31402 libavahi-common-data_0.6.23-3lenny3_i386.deb 4d0abd1d355f67593590629cd9b06136732c9e53e8f5fa629e153f0b427f85fc 66814 libavahi-common-dev_0.6.23-3lenny3_i386.deb 55a7354e932d4c689056dc45cee18dee736d9f2913845ee487193ed05d9c4f99 115474 libavahi-core5_0.6.23-3lenny3_i386.deb d9afb38f94b954fd236a0db3c78335846faad99f4345771b8ca8d40767046697 152008 libavahi-core-dev_0.6.23-3lenny3_i386.deb 034dfbeb05a31d6ac29e0b203bc7cf2a4c839b44cc70a11a778ab00cf84f86a1 52082 libavahi-client3_0.6.23-3lenny3_i386.deb d274daef7b7667f4cb5f90c2d48b9377948b682c4fa3c018a56623b8387d69ae 61906 libavahi-client-dev_0.6.23-3lenny3_i386.deb ee85ff214981670fc276feba44c3867cc75ba917fe3093547b29fff082e43b17 32380 libavahi-glib1_0.6.23-3lenny3_i386.deb a38d311b4a71e97682966100b4c2669a26733d13c5b1ab06ad40728b3a40b624 33974 libavahi-glib-dev_0.6.23-3lenny3_i386.deb 23cf32f3b586396dc089d537f3084d539f995c9fd2fd634e8995ae98b54388b7 42254 libavahi-gobject0_0.6.23-3lenny3_i386.deb 68dac6b5e7d41883f305d2817a5f1cc5301d149a5addc1b216be05c2683cd247 49246 libavahi-gobject-dev_0.6.23-3lenny3_i386.deb 44a85a9e65ef726d834966a9b29468525079b2ba638f2771e4acf5a486b43d15 33818 libavahi-qt3-1_0.6.23-3lenny3_i386.deb f0991e6b34330e34b9fe891405aae57319ee737fab7d3a6e9b41f9de99e43833 34260 libavahi-qt3-dev_0.6.23-3lenny3_i386.deb 09642357d2b09e24b3c35f02c5cfa40253373f9d278ac7cfc721f835b40a815f 31896 libavahi-qt4-1_0.6.23-3lenny3_i386.deb 857a56b4a62edff3b0f309790175d4aac4448ac6d423f93dda27db770d470a8d 32634 libavahi-qt4-dev_0.6.23-3lenny3_i386.deb 68f873d0a4940fc0e14647371310becc4f94393225e3354e300d19cb8b2c8610 47140 libavahi-compat-howl0_0.6.23-3lenny3_i386.deb 11e117516c7ffdba8fc2ff1a3503421797a5488ec1fe655d11353336c053ace4 60240 libavahi-compat-howl-dev_0.6.23-3lenny3_i386.deb 47cd2674baf883da1464f30bf4fed5fc8239ca933538646de7fff833d2fbeb13 40748 libavahi-compat-libdnssd1_0.6.23-3lenny3_i386.deb 1a6351c79bf543b279812ab88cd11f1a4dfae797be3ad128e7978f2b956d7509 59774 libavahi-compat-libdnssd-dev_0.6.23-3lenny3_i386.deb 9ebee404bdba13ac4f52fdaf67f14216959a8e122fcc8b0fe9a00637b39af9c7 45862 libavahi-ui0_0.6.23-3lenny3_i386.deb 99cf8ce54e247bae9483364f69dbed3774caca1b612af84644d1313783506ce4 46958 libavahi-ui-dev_0.6.23-3lenny3_i386.deb ebbc487ab52e3b92c0a30390b376d48464cab90e47d0dc1c9f61c981847bbb7d 33962 avahi-ui-utils_0.6.23-3lenny3_i386.deb bc37868db0137e82e111ff0b72bef36c33a19abea28c8352d7971b9740308bb3 650148 avahi-dbg_0.6.23-3lenny3_i386.deb Files: 8bf4f30558b4388e7d670c694ac3695f 2959 net optional avahi_0.6.23-3lenny3.dsc 7d4ae691d688e271bd407013d47185bb 32733 net optional avahi_0.6.23-3lenny3.diff.gz a7461b52796b7f8e3a70b739bf109086 29538 python optional python-avahi_0.6.23-3lenny3_all.deb 5c5db4185e745e25975977798e71edc1 36760 net optional avahi-discover_0.6.23-3lenny3_all.deb b15245dc5a39a8ea32062c00fa8b7fd0 87972 net optional avahi-daemon_0.6.23-3lenny3_i386.deb d5b06f1dd298811451aecd6caa4301e1 38754 net optional avahi-dnsconfd_0.6.23-3lenny3_i386.deb 55331b0b45568efcfcbaa01460802e2e 48828 net optional avahi-autoipd_0.6.23-3lenny3_i386.deb a82349ff460e3d6f7a5be25d59226ebb 51194 net optional avahi-utils_0.6.23-3lenny3_i386.deb 6d3c0711f0718c2d5749e008bfbbe41f 48044 libs optional libavahi-common3_0.6.23-3lenny3_i386.deb 703f2c7f891efc2a3afeca55a42c5888 31402 libs optional libavahi-common-data_0.6.23-3lenny3_i386.deb 127d39b3f20be6bcab05941547d4c566 66814 libdevel optional libavahi-common-dev_0.6.23-3lenny3_i386.deb a5bb8dcdc71e966ff7fa80f28a6938d2 115474 libs optional libavahi-core5_0.6.23-3lenny3_i386.deb f535ff960dca810ea616c3d921bcb7c5 152008 libdevel optional libavahi-core-dev_0.6.23-3lenny3_i386.deb 3295e3ca7855e2eeb3675bcd107bf3eb 52082 libs optional libavahi-client3_0.6.23-3lenny3_i386.deb 18cc792aa6326d690d54b9152a9ed8e5 61906 libdevel optional libavahi-client-dev_0.6.23-3lenny3_i386.deb cfa8d792050586c3b7f45ba4860a6d86 32380 libs optional libavahi-glib1_0.6.23-3lenny3_i386.deb c8f80a97219045f5f61d171a657332e8 33974 libdevel optional libavahi-glib-dev_0.6.23-3lenny3_i386.deb bc3b0f9b21f3b8bafc4df521313870d8 42254 libs optional libavahi-gobject0_0.6.23-3lenny3_i386.deb fba1cfee8d633b5671abda337b0b3d3d 49246 libdevel optional libavahi-gobject-dev_0.6.23-3lenny3_i386.deb 1220242cdb3be2ec6535a313c57ec882 33818 libs optional libavahi-qt3-1_0.6.23-3lenny3_i386.deb 04214e03cd30f8a95090713729f2c5b1 34260 libdevel optional libavahi-qt3-dev_0.6.23-3lenny3_i386.deb e6b22d65e82ee2e9dde5cf8b48d40124 31896 libs optional libavahi-qt4-1_0.6.23-3lenny3_i386.deb 811812059705dc1692fa316ae53d3cf1 32634 libdevel optional libavahi-qt4-dev_0.6.23-3lenny3_i386.deb 5f7aaf62f175a8b1ed249b4b1fa83a01 47140 libs optional libavahi-compat-howl0_0.6.23-3lenny3_i386.deb 3a4a90133c1243b981c207245c35ccb7 60240 libdevel optional libavahi-compat-howl-dev_0.6.23-3lenny3_i386.deb 65e503a6408f705c47ccb5ccf175a8fd 40748 libs optional libavahi-compat-libdnssd1_0.6.23-3lenny3_i386.deb b3313ea89f3b918d9172ad522aeebe3a 59774 libdevel optional libavahi-compat-libdnssd-dev_0.6.23-3lenny3_i386.deb 6d5f6c9ea841f6af8aaafc8a74e6be1e 45862 libs optional libavahi-ui0_0.6.23-3lenny3_i386.deb 8109d104a0eb6dd4d5fd5980c095976d 46958 libdevel optional libavahi-ui-dev_0.6.23-3lenny3_i386.deb 222d9852dd9a27ffbfa7593adfb02201 33962 libs optional avahi-ui-utils_0.6.23-3lenny3_i386.deb 1821590a2e6981e8c2d6d26272ab31e6 650148 libdevel extra avahi-dbg_0.6.23-3lenny3_i386.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBCAAGBQJNZm6YAAoJEGrh4w1gjyLckIEP/A2FR18rKrxpWJYFAoPEk5H2 Nf3/bxHVfr813fIonYEziYRIbesE1v6GO2oD0y4hzTPGlmvb8t1c1RwsKVnaH7Yg xv6aazmK4tpU3keRQpHtLXy9PAkZYNtkcaB4CkaKc3lINdHYs1BuIvmIZ5SlMc+l IGKXfDp3JCs4o2lKr3oF1eiClwgBbdpt1sfUycBMX6cS2Tj9V1DUBi/HtnT3fqUQ UKCLAVoKRzdUAwxW4xvpL6ORBIPGRZUqXZluHDDluzTjyOKwnHeMc+HTBzXqjsyY 1wrN38WOKWKhBdjlS1k/ytdq5rvUxvtLDSp0ddcLFtfInXv7Pp0Y4V7eO6AcE38D WRi52pHVqfoIX16P0Mh4ZFIoq//Pf0iyq3uZ3viqyrLQmaJBc//GrV22i1x4qwpv eQLOlWy+I/j7wDyabqoahpgOvoVi5pXaPzkt5rFu9Tctf6iV0j4PQ0fWpbUgc8A4 nA0jeLbLzRVIgavmjieeV6d3cUaxgThF4OD8/2a4N+HBjY035GZVZks18TF9l6Nq nah8BkukDe4VDVPNDX9K764um+00lTVlaHgljS2IDWutYdAql1ekDWUO5v4i35tN gTRl+iQE0MPWDJQnuWU3I3BoVQbQbkjOTqfG56cc9vone2sxVT0aHaDvVvUkYalI W3XDoLWyv91ssUTUWyOr =YzKs -----END PGP SIGNATURE-----
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org.
(Sat, 02 Apr 2011 07:42:15 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.
Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.
Vulmon