CVE-2024-52615
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A flaw in Avahi-daemon uses fixed source ports for wide-area DNS queries, making it easier for attackers to inject malicious DNS responses.
Risk Assessment
The organization is at risk of DNS spoofing attacks that can redirect traffic to malicious servers, leading to data theft or malware infection.
Recommendation
Update Avahi-daemon to the latest version that randomizes source ports for DNS queries, and consider implementing DNSSEC for additional protection.
Other vulnerabilities in Avahi-daemon
See all- CVE-2017-6519Critical
avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, allowing remote attackers to cause a denial of service (traffic amplification) and may lead to information leakage.
- CVE-2024-52616Medium
A flaw was found in Avahi-daemon where DNS transaction IDs are initialized randomly only once at startup and then incremented sequentially. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.
Original NVD description (English source)
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.