Test ID:	1.3.6.1.4.1.25623.1.0.59438
Category:	Fedora Local Security Checks
Title:	Fedora Core 5 FEDORA-2007-018 (avahi)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to avahi announced via advisory FEDORA-2007-018. Avahi is a system which facilitates service discovery on a local network -- this means that you can plug your laptop or computer into a network and instantly be able to view other people who you can chat with, find printers to print to or find files being shared. This kind of technology is already found in MacOS X (branded 'Rendezvous', 'Bonjour' and sometimes 'ZeroConf') and is very convenient. Update Information: avahi-0.6.11-3.fc5 should fix CVE-2006-6870 - the consume_labels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) via a crafted compressed DNS response with a label that points to itself. * Sat Jan 6 2007 Martin Bacovsky - 0.6.11-3.fc5 - Resolves: #221726 - CVE-2006-6870 Maliciously crafted packed can DoS avahi daemon * Tue Nov 28 2006 Martin Bacovsky - 0.6.11-2.fc5 - fix bug #216655 - CVE-2006-5461 - avahi did not verify the sender identity of netlink messages * Mon Jul 17 2006 Jason Vas Dias - 0.6.11-1 - Upgrade to upstream version 0.6.11 - fix bug 195674: set 'use-ipv6=yes' in avahi-daemon.conf - fix bug 197414: avahi-compat-howl and avahi-compat-dns-sd symlinks - fix bug 198282: avahi-compat-{howl-devel,dns-sd-devel} Requires: * Tue Jun 13 2006 Jason Vas Dias - 0.6.10-3 - rebuild for broken mono deps * Tue Jun 6 2006 Jason Vas Dias - 0.6.10-2 - fix bug 194203: fix permissions on /var/run/avahi-daemon * Tue May 30 2006 Jason Vas Dias - 0.6.10-1 - Upgrade to upstream version 0.6.10 - fix bug 192080: split avahi-compat-libdns_sd into separate package (same goes for avahi-compat-howl) Solution: Apply the appropriate updates. This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/ This update can be installed with the 'yum' update program. Use 'yum update package-name' at the command line. For more information, refer to 'Managing Software with yum,' available at http://fedora.redhat.com/docs/yum/. http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2007-018 Risk factor : Medium CVSS Score: 5.0
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2006-6870 BugTraq ID: 21881 http://www.securityfocus.com/bid/21881 http://fedoranews.org/cms/node/2362 http://fedoranews.org/cms/node/2408 http://www.mandriva.com/security/advisories?name=MDKSA-2007:003 http://secunia.com/advisories/23628 http://secunia.com/advisories/23644 http://secunia.com/advisories/23660 http://secunia.com/advisories/23673 http://secunia.com/advisories/23782 http://secunia.com/advisories/24995 SuSE Security Announcement: SUSE-SR:2007:007 (Google Search) http://www.novell.com/linux/security/advisories/2007_007_suse.html http://www.ubuntu.com/usn/usn-402-1 http://www.vupen.com/english/advisories/2007/0071 Common Vulnerability Exposure (CVE) ID: CVE-2006-5461 BugTraq ID: 21016 http://www.securityfocus.com/bid/21016 http://www.gentoo.org/security/en/glsa/glsa-200611-13.xml http://www.mandriva.com/security/advisories?name=MDKSA-2006:215 https://tango.0pointer.de/pipermail/avahi-tickets/2006-November/000320.html http://securitytracker.com/id?1017257 http://secunia.com/advisories/22807 http://secunia.com/advisories/22852 http://secunia.com/advisories/22932 http://secunia.com/advisories/23020 http://secunia.com/advisories/23042 SuSE Security Announcement: SUSE-SR:2006:026 (Google Search) http://www.novell.com/linux/security/advisories/2006_26_sr.html https://usn.ubuntu.com/380-1/ http://www.vupen.com/english/advisories/2006/4474 XForce ISS Database: avahi-netlink-security-bypass(30207) https://exchange.xforce.ibmcloud.com/vulnerabilities/30207
Copyright	Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.