リモートの Redhat Enterprise Linux 8 ホストにインストールされているパッケージは、RHSA-2024: 0418 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  -バージョン 0.6〜0.8 の avahi に欠陥が見つかりました。avahi Unix ソケット上のクライアント接続の終了を通知するために使用されるイベントが client_work 関数で適切に処理されていません。これにより、ローカルの攻撃者が無限ループを発生させる可能性があります。この脆弱性による最大の脅威は、avahi サービスの可用性であり、この欠陥がトリガーされた後、応答しなくなります。
    (CVE-2021-3468)

  - Avahi に脆弱性が見つかりました。avahi_dns_packet_append_record に到達可能なアサーションが存在します。
    (CVE-2023-38469)

  - Avahi に脆弱性が見つかりました。avahi_escape_label() 関数に到達可能なアサーションが存在します。
    (CVE-2023-38470)

  - Avahi に脆弱性が見つかりました。dbus_set_host_name 関数に到達可能なアサーションが存在します。
    (CVE-2023-38471)

  - Avahi に脆弱性が見つかりました。avahi_rdata_parse() 関数に到達可能なアサーションが存在します。
    (CVE-2023-38472)

  - Avahi に脆弱性が見つかりました。avahi_alternative_host_name() 関数に到達可能なアサーションが存在します。(CVE-2023-38473)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモート Redhat Enterprise Linux 8 ホストに、RHSA-2024:0576 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - avahi: /run/avahi-daemon/socket への長い行の書き込みからの event-busy-loop によるローカル DoS (CVE-2021-3468)

  - avahi: avahi_dns_packet_append_record における到達可能なアサーション (CVE-2023-38469)

  - avahi: avahi_escape_label における到達可能なアサーション (CVE-2023-38470)

  - avahi: dbus_set_host_name における到達可能なアサーション (CVE-2023-38471)

  - avahi: avahi_rdata_parse における到達可能なアサーション (CVE-2023-38472)

  - avahi: avahi_alternative_host_name における到達可能なアサーション (CVE-2023-38473)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端 Redhat Enterprise Linux 8 主機上安裝的多個套件受到 RHSA-2024:0576 公告中提及的多個弱點影響。

  - avahi：將長行寫入 /run/avahi-daemon/socket 時，event-busy-loop 引發本機 DoS (CVE-2021-3468)

  - avahi：avahi_dns_packet_append_record 中的可存取宣告 (CVE-2023-38469)

  - avahi：avahi_escape_label 中的可存取宣告 (CVE-2023-38470)

  - avahi：dbus_set_host_name 中的可存取宣告 (CVE-2023-38471)

  - avahi：avahi_rdata_parse 中的可存取宣告 (CVE-2023-38472)

  - avahi：avahi_alternative_host_name 中的可存取宣告 (CVE-2023-38473)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2024: 0418 公告中提及的一個弱點影響。

  - 在 0.6 到 0.8 版本的 avahi 中發現一個缺陷。在 client_work 函式中未正確處理用於針對 avahi Unix 通訊端上用戶端連線終止發出訊號的事件，進而允許本機攻擊者觸發無限迴圈。此弱點對 avahi 服務可用性的威脅最大，其在觸發此缺陷後會停止回應。
    (CVE-2021-3468)

  - 在 Avahi 中發現一個弱點，當中的 avahi_dns_packet_append_record 存在可執行的判斷提示。
    (CVE-2023-38469)

  - 在 Avahi 中發現一個弱點。avahi_escape_label() 函式中存在可執行的判斷提示。
    (CVE-2023-38470)

  - 在 Avahi 中發現一個弱點。dbus_set_host_name 函式中存在可執行的判斷提示。
    (CVE-2023-38471)

  - 在 Avahi 中發現一個弱點。avahi_rdata_parse() 函式中存在可執行的判斷提示。
    (CVE-2023-38472)

  - 在 Avahi 中發現一個弱點。avahi_alternative_host_name() 函式中存在可執行的判斷提示。(CVE-2023-38473)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 CentOS Linux 8 主機上安裝的套件受到 CESA-2023: 7836 公告中提及的多個弱點影響。

  - 在 0.6 到 0.8 版本的 avahi 中發現一個缺陷。在 client_work 函式中未正確處理用於針對 avahi Unix 通訊端上用戶端連線終止發出訊號的事件，進而允許本機攻擊者觸發無限迴圈。此弱點對 avahi 服務可用性的威脅最大，其在觸發此缺陷後會停止回應。
    (CVE-2021-3468)

  - 在 Avahi 中發現一個弱點，當中的 avahi_dns_packet_append_record 存在可執行的判斷提示。
    (CVE-2023-38469)

  - 在 Avahi 中發現一個弱點。avahi_escape_label() 函式中存在可執行的判斷提示。
    (CVE-2023-38470)

  - 在 Avahi 中發現一個弱點。dbus_set_host_name 函式中存在可執行的判斷提示。
    (CVE-2023-38471)

  - 在 Avahi 中發現一個弱點。avahi_rdata_parse() 函式中存在可執行的判斷提示。
    (CVE-2023-38472)

  - 在 Avahi 中發現一個弱點。avahi_alternative_host_name() 函式中存在可執行的判斷提示。(CVE-2023-38473)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 CentOS Linux 9 主機上安裝的套件受到 avahi-0.8-20.el9 版本變更記錄中提及的多個弱點所影響。

  - 在 Avahi 中發現一個弱點，當中的 avahi_dns_packet_append_record 存在可執行的判斷提示。
    (CVE-2023-38469)

  - 在 Avahi 中發現一個弱點。avahi_escape_label() 函式中存在可執行的判斷提示。
    (CVE-2023-38470)

  - 在 Avahi 中發現一個弱點。dbus_set_host_name 函式中存在可執行的判斷提示。
    (CVE-2023-38471)

  - 在 Avahi 中發現一個弱點。avahi_rdata_parse() 函式中存在可執行的判斷提示。
    (CVE-2023-38472)

  - 在 Avahi 中發現一個弱點。avahi_alternative_host_name() 函式中存在可執行的判斷提示。(CVE-2023-38473)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 9 主機上安裝的多個套件受到 RHSA-2024:2433 公告中提及的多個弱點影響。

  - avahi：avahi_dns_packet_append_record 中的可存取宣告 (CVE-2023-38469)

  - avahi：avahi_escape_label 中的可連線宣告 (CVE-2023-38470)

  - avahi：dbus_set_host_name 中的可連線宣告 (CVE-2023-38471)

  - avahi：avahi_rdata_parse 中的可存取宣告 (CVE-2023-38472)

  - avahi：avahi_alternative_host_name 中的可存取宣告 (CVE-2023-38473)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
    (CVE-2023-38469)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
    (CVE-2023-38470)

  - A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
    (CVE-2023-38471)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
    (CVE-2023-38472)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name()     function. (CVE-2023-38473)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the avahi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
    (CVE-2023-38469)

  - A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
    (CVE-2023-38471)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
    (CVE-2023-38472)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name()     function. (CVE-2023-38473)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the avahi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
    (CVE-2023-38469)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
    (CVE-2023-38470)

  - A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
    (CVE-2023-38471)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
    (CVE-2023-38472)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name()     function. (CVE-2023-38473)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7836 advisory.

  - A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
    (CVE-2023-38469)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
    (CVE-2023-38472)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
    (CVE-2023-38470)

  - A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the     client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing     a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the     availability of the avahi service, which becomes unresponsive after this flaw is triggered.
    (CVE-2021-3468)

  - A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
    (CVE-2023-38471)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name()     function. (CVE-2023-38473)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4910-1 advisory.

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
    (CVE-2023-38470)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name()     function. (CVE-2023-38473)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:7836 advisory.

  - A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the     client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing     a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the     availability of the avahi service, which becomes unresponsive after this flaw is triggered.
    (CVE-2021-3468)

  - A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
    (CVE-2023-38469)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
    (CVE-2023-38470)

  - A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
    (CVE-2023-38471)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
    (CVE-2023-38472)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name()     function. (CVE-2023-38473)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6487-1 advisory.

    Evgeny Vereshchagin discovered that Avahi contained several reachable

    assertions, which could lead to intentional assertion failures when

    specially crafted user input was given. An attacker could possibly use this issue to cause a denial of     service. (CVE-2023-38469, CVE-2023-38470, CVE-2023-38471, CVE-2023-38472, CVE-2023-38473)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
189560	RHEL 8: avahi (RHSA-2024: 0418)	Nessus	Red Hat Local Security Checks	2024/1/25	2024/6/3	medium
189795	RHEL 8 : avahi (RHSA-2024:0576)	Nessus	Red Hat Local Security Checks	2024/1/30	2024/6/3	medium
189795	RHEL 8：avahi (RHSA-2024:0576)	Nessus	Red Hat Local Security Checks	2024/1/30	2024/6/3	medium
189560	RHEL 8：avahi (RHSA-2024: 0418)	Nessus	Red Hat Local Security Checks	2024/1/25	2024/6/3	medium
187732	CentOS 8：avahi (CESA-2023: 7836)	Nessus	CentOS Local Security Checks	2024/1/9	2024/2/8	medium
193939	CentOS 9：avahi-0.8-20.el9	Nessus	CentOS Local Security Checks	2024/4/26	2024/4/26	medium
194757	RHEL 9：avahi (RHSA-2024:2433)	Nessus	Red Hat Local Security Checks	2024/4/30	2024/6/3	medium
192356	EulerOS Virtualization 2.11.0 : avahi (EulerOS-SA-2024-1438)	Nessus	Huawei Local Security Checks	2024/3/21	2024/3/21	medium
190277	EulerOS 2.0 SP9 : avahi (EulerOS-SA-2024-1191)	Nessus	Huawei Local Security Checks	2024/2/8	2024/2/8	medium
188889	EulerOS 2.0 SP10 : avahi (EulerOS-SA-2024-1077)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
187049	Oracle Linux 8 : avahi (ELSA-2023-7836)	Nessus	Oracle Linux Local Security Checks	2023/12/18	2023/12/21	medium
187116	SUSE SLES15 / openSUSE 15 Security Update : avahi (SUSE-SU-2023:4910-1)	Nessus	SuSE Local Security Checks	2023/12/20	2023/12/21	medium
187717	Rocky Linux 8 : avahi (RLSA-2023:7836)	Nessus	Rocky Linux Local Security Checks	2024/1/9	2024/1/9	medium
186016	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Avahi vulnerabilities (USN-6487-1)	Nessus	Ubuntu Local Security Checks	2023/11/20	2024/8/27	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium