Your message dated Mon, 05 Jan 2009 19:52:27 +0000
with message-id <[email protected]>
and subject line Bug#508700: fixed in avahi 0.6.16-3etch2
has caused the Debian Bug report #508700,
regarding [CVE-2008-5081] avahi daemon DoS through zero source port
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
508700: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508700
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: avahi-daemon
Version: 0.6.23-2
Severity: important
Tags: security
A UDP packet with a source port of zero causes avahi-daemon to abort.
Upstream commit is:
<http://git.0pointer.de/?p=avahi.git;a=commitdiff;h=3093047f1aa36bed8a37fa79004bf0ee287929f4>
Please mention CVE-2008-5081 in the changelog when fixing this issue.
--- End Message ---
--- Begin Message ---
Source: avahi
Source-Version: 0.6.16-3etch2
We believe that the bug you reported is fixed in the latest version of
avahi, which is due to be installed in the Debian FTP archive:
avahi-autoipd_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/avahi-autoipd_0.6.16-3etch2_amd64.deb
avahi-daemon_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/avahi-daemon_0.6.16-3etch2_amd64.deb
avahi-discover_0.6.16-3etch2_all.deb
to pool/main/a/avahi/avahi-discover_0.6.16-3etch2_all.deb
avahi-dnsconfd_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/avahi-dnsconfd_0.6.16-3etch2_amd64.deb
avahi-utils_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/avahi-utils_0.6.16-3etch2_amd64.deb
avahi_0.6.16-3etch2.diff.gz
to pool/main/a/avahi/avahi_0.6.16-3etch2.diff.gz
avahi_0.6.16-3etch2.dsc
to pool/main/a/avahi/avahi_0.6.16-3etch2.dsc
libavahi-client-dev_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-client-dev_0.6.16-3etch2_amd64.deb
libavahi-client3_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-client3_0.6.16-3etch2_amd64.deb
libavahi-common-data_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-common-data_0.6.16-3etch2_amd64.deb
libavahi-common-dev_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-common-dev_0.6.16-3etch2_amd64.deb
libavahi-common3_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-common3_0.6.16-3etch2_amd64.deb
libavahi-compat-howl-dev_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-compat-howl-dev_0.6.16-3etch2_amd64.deb
libavahi-compat-howl0_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-compat-howl0_0.6.16-3etch2_amd64.deb
libavahi-compat-libdnssd-dev_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-compat-libdnssd-dev_0.6.16-3etch2_amd64.deb
libavahi-compat-libdnssd1_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-compat-libdnssd1_0.6.16-3etch2_amd64.deb
libavahi-core-dev_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-core-dev_0.6.16-3etch2_amd64.deb
libavahi-core4_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-core4_0.6.16-3etch2_amd64.deb
libavahi-glib-dev_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-glib-dev_0.6.16-3etch2_amd64.deb
libavahi-glib1_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-glib1_0.6.16-3etch2_amd64.deb
libavahi-qt3-1_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-qt3-1_0.6.16-3etch2_amd64.deb
libavahi-qt3-dev_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-qt3-dev_0.6.16-3etch2_amd64.deb
libavahi-qt4-1_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-qt4-1_0.6.16-3etch2_amd64.deb
libavahi-qt4-dev_0.6.16-3etch2_amd64.deb
to pool/main/a/avahi/libavahi-qt4-dev_0.6.16-3etch2_amd64.deb
python-avahi_0.6.16-3etch2_all.deb
to pool/main/a/avahi/python-avahi_0.6.16-3etch2_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sjoerd Simons <[email protected]> (supplier of updated avahi package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sun, 21 Dec 2008 15:20:21 +0000
Source: avahi
Binary: python-avahi libavahi-client3 avahi-autoipd libavahi-glib-dev
libavahi-common-data avahi-utils libavahi-common-dev libavahi-qt3-1
libavahi-glib1 libavahi-qt4-dev libavahi-qt4-1 avahi-dnsconfd avahi-discover
libavahi-compat-libdnssd-dev libavahi-compat-howl-dev libavahi-common3
libavahi-core-dev libavahi-compat-howl0 libavahi-core4 libavahi-client-dev
libavahi-compat-libdnssd1 libavahi-qt3-dev avahi-daemon
Architecture: source all amd64
Version: 0.6.16-3etch2
Distribution: stable-security
Urgency: high
Maintainer: Utopia Maintenance Team
<[email protected]>
Changed-By: Sjoerd Simons <[email protected]>
Description:
avahi-autoipd - Avahi IPv4LL network address configuration daemon
avahi-daemon - Avahi mDNS/DNS-SD daemon
avahi-discover - Service discover user interface for avahi
avahi-dnsconfd - Avahi DNS configuration tool
avahi-utils - Avahi browsing, publishing and discovery utilities
libavahi-client-dev - Development files for the Avahi client library
libavahi-client3 - Avahi client library
libavahi-common-data - Avahi common data files
libavahi-common-dev - Development files for the Avahi common library
libavahi-common3 - Avahi common library
libavahi-compat-howl-dev - Development headers for the Avahi Howl
compatibility library
libavahi-compat-howl0 - Avahi Howl compatibility library
libavahi-compat-libdnssd-dev - Development headers for the Avahi Apple Bonjour
compatibility lib
libavahi-compat-libdnssd1 - Avahi Apple Bonjour compatibility library
libavahi-core-dev - Development files for Avahi's embeddable mDNS/DNS-SD
library
libavahi-core4 - Avahi's embeddable mDNS/DNS-SD library
libavahi-glib-dev - Development headers for the Avahi glib integration library
libavahi-glib1 - Avahi glib integration library
libavahi-qt3-1 - Avahi Qt3 integration library
libavahi-qt3-dev - Development headers for the Avahi Qt3 integration library
libavahi-qt4-1 - Avahi Qt4 integration library
libavahi-qt4-dev - Development headers for the Avahi Qt4 integration library
python-avahi - Python utility package for Avahi
Closes: 508700
Changes:
avahi (0.6.16-3etch2) stable-security; urgency=high
.
* debian/patches/14_CVE-2008-5081.patch
- Added. Don't abort on receiving an UDP packet with a source port of zero.
Fixes CVE-2008-5081 (Closes: #508700)
* debian/patches/15_CVE-2007-3372.patch
- Added. Fix an assertion failure in the daemon when trying to register
empty TXT records Fixes CVE-2007-3372
Files:
c6d82509d185e92342b59d1c326f3c3f 1570 net optional avahi_0.6.16-3etch2.dsc
9d5294285d17b21e7c43f5dca5563501 19735 net optional avahi_0.6.16-3etch2.diff.gz
7c33a20bb4ac8fe49b06358b64863afd 25654 python optional
python-avahi_0.6.16-3etch2_all.deb
87cb2fa52eb0d899eb44f329269b3a48 25370 net optional
avahi-discover_0.6.16-3etch2_all.deb
d3eb11ea0cd2d1a40e57efdbcfea80d5 79016 net optional
avahi-daemon_0.6.16-3etch2_amd64.deb
c3c41140cffbe2ce2b18696316c98c94 31896 net optional
avahi-dnsconfd_0.6.16-3etch2_amd64.deb
95a70befcc20c947fa71ef7fcc48928a 40726 net optional
avahi-autoipd_0.6.16-3etch2_amd64.deb
635538806e9cbf96e67db566f0088be5 44194 net optional
avahi-utils_0.6.16-3etch2_amd64.deb
16104894997c67e9d38447ed30f46d41 40012 libs optional
libavahi-common3_0.6.16-3etch2_amd64.deb
c3383652aa1f332616f7bc673957c678 22960 libs optional
libavahi-common-data_0.6.16-3etch2_amd64.deb
2f517cb85747971221240d0e601b0b2d 58174 libdevel optional
libavahi-common-dev_0.6.16-3etch2_amd64.deb
977f06e22ba9f924c3b44d28fe4f380a 109494 libs optional
libavahi-core4_0.6.16-3etch2_amd64.deb
a5c017fb015614778dd610741d5dcb20 145814 libdevel optional
libavahi-core-dev_0.6.16-3etch2_amd64.deb
234268824fa70ebbfac633bc9c657442 45964 libs optional
libavahi-client3_0.6.16-3etch2_amd64.deb
1aae9b49d5f708587424961ffcf81f2b 53664 libdevel optional
libavahi-client-dev_0.6.16-3etch2_amd64.deb
349b10f1cf5d48d27ad722d8168c7ddd 25210 libs optional
libavahi-glib1_0.6.16-3etch2_amd64.deb
3fa256ab9c1d8264e70342cbf051450b 26590 libdevel optional
libavahi-glib-dev_0.6.16-3etch2_amd64.deb
b3fa7b9c170b3af2e28a2cbad5a05293 27532 libs optional
libavahi-qt3-1_0.6.16-3etch2_amd64.deb
ea1815a3bae76db9c36efe85febf250b 27608 libdevel optional
libavahi-qt3-dev_0.6.16-3etch2_amd64.deb
4bdda9245f0b1eabb1c7b12e083b63e3 25406 libs optional
libavahi-qt4-1_0.6.16-3etch2_amd64.deb
684e0684a12391a1c6583b8f336a946c 25676 libdevel optional
libavahi-qt4-dev_0.6.16-3etch2_amd64.deb
4ae56f1598581e8ea8e2827789a6eef2 39460 libs optional
libavahi-compat-howl0_0.6.16-3etch2_amd64.deb
f4c32d9bad952bf42cf917f58ec3af0e 53330 libdevel optional
libavahi-compat-howl-dev_0.6.16-3etch2_amd64.deb
213fc438640d1a567d543249f5ea8962 34562 libs optional
libavahi-compat-libdnssd1_0.6.16-3etch2_amd64.deb
45177d78b0bba115f1ba59c6f86ef720 53440 libdevel optional
libavahi-compat-libdnssd-dev_0.6.16-3etch2_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAklOYgkACgkQgTd+SodosdKqJgCfdBRF6jihWSwfDd1ydRv/63Ql
9GkAnAw19opCZdgohfCPNMoWx3gUIgHZ
=sJ5H
-----END PGP SIGNATURE-----
--- End Message ---
