This update for avahi fixes the following issues :

CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)

Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d.

Add sudo to requires: used to drop privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of avahi installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-26720 advisory.

  - avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via     /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create     arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the     packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product. (CVE-2021-26720)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for avahi fixes the following issues :

CVE-2021-3468: avoid infinite loop by handling HUP event in client_work (bsc#1184521).

CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)

Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d.

Add sudo to requires: used to drop privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1845-1 advisory.

  - avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via     /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create     arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the     packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product. (CVE-2021-26720)

  - A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the     client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing     a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the     availability of the avahi service, which becomes unresponsive after this flaw is triggered.
    (CVE-2021-3468)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3047 advisory.

  - avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via     /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create     arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the     packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product. (CVE-2021-26720)

  - A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the     client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing     a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the     availability of the avahi service, which becomes unresponsive after this flaw is triggered.
    (CVE-2021-3468)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for avahi fixes the following issues :

  - CVE-2021-26720: drop privileges when invoking     avahi-daemon-check-dns.sh (bsc#1180827)

  - Update avahi-daemon-check-dns.sh from Debian. Our     previous version relied on ifconfig, route, and init.d.

  - Add sudo to requires: used to drop privileges.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for avahi fixes the following issues :

CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh (bsc#1180827)

Add sudo to requires: used to drop privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
146794	SUSE SLED15 / SLES15 Security Update : avahi (SUSE-SU-2021:0551-1)	Nessus	SuSE Local Security Checks	2/24/2021	3/1/2021	high
201775	CBL Mariner 2.0 Security Update: avahi (CVE-2021-26720)	Nessus	MarinerOS Local Security Checks	7/3/2024	7/3/2024	high
150267	SUSE SLES15 Security Update : avahi (SUSE-SU-2021:1845-1)	Nessus	SuSE Local Security Checks	6/4/2021	12/27/2023	high
151724	openSUSE 15 Security Update : avahi (openSUSE-SU-2021:1845-1)	Nessus	SuSE Local Security Checks	7/16/2021	7/16/2021	high
161940	Debian DLA-3047-1 : avahi - LTS security update	Nessus	Debian Local Security Checks	6/8/2022	6/8/2022	high
147159	openSUSE Security Update : avahi (openSUSE-2021-370)	Nessus	SuSE Local Security Checks	3/5/2021	1/12/2024	high
146797	SUSE SLES12 Security Update : avahi (SUSE-SU-2021:0563-1)	Nessus	SuSE Local Security Checks	2/24/2021	3/1/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high