DNS Spoofing Vulnerability in Avahi Package
Summary
ALPINE-CVE-2024-52616: A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. Affects avahi versions < 0.8-r21. Fixed in 0.8-r21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Avahi is a service discovery system that facilitates the discovery of services on a local network via the DNS-SD (DNS Service Discovery) protocol. It is widely used in various Linux distributions, including Alpine Linux, to enable seamless interaction between devices on a network. The Avahi-daemon is responsible for managing these service advertisements and discoveries. However, a flaw has been identified in its DNS transaction ID handling, which could expose systems to DNS spoofing attacks.
Vulnerability Detail
A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. This vulnerability can lead to unauthorized access to network services and potential data interception, posing significant security risks to affected systems.
How To Fix
Minimum fixed version
0.8-r21
This is the first release that contains the fix.
sudo apk add --upgrade avahiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can consider implementing network-level security measures, such as using firewalls to restrict access to the Avahi service or employing DNSSEC to enhance DNS security. However, these measures do not fully mitigate the risk and should not replace updating the package.
Conclusion
The Avahi package has a vulnerability that allows for DNS spoofing due to predictable transaction IDs. Users are advised to update to the latest patched version to mitigate this risk. Implementing additional security measures can provide temporary relief, but updating the package is essential for long-term security.
See every vulnerability recorded for avahi →
FAQ
Avahi is a service discovery system that allows devices on a local network to discover each other and the services they offer.
DNS spoofing is a technique used by attackers to send false DNS responses, redirecting users to malicious sites.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
The risks include unauthorized access to network services, potential data interception, and exploitation of the affected systems.
Yes, updating the Avahi package to the fixed version (0.8-r21 or later) is the permanent solution to this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for avahi.
