Avahi vulnerabilities

Avahi, a system for service discovery on a local network via mDNS/DNS-SD, prior to version 0.9-rc4 is vulnerable to a DoS attack. Any unprivileged local user can send a single D-Bus method call with conflicting publish flags, causing avahi-daemon to crash.

Avahi in versions 0.9rc2 and below allows crashing avahi-daemon via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record where the alias and canonical name point to the same domain. This causes unbounded recursion in lookup_handle_cname and stack exhaustion. The vulnerability affects record browsers with AVAHI_LOOKUP_USE_MULTICAST explicitly set, including those created by resolvers used by nss-mdns.

In Avahi versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections. The lack of a check against CLIENTS_MAX allows an unprivileged local user to exhaust daemon memory and file descriptors, causing a local denial of service (DoS) for mDNS/DNS-SD. As of publication, no known patched versions are available, but a candidate fix is available in pull request 808 and some workarounds exist.