------------------------------------------------------------------------
Pardus Linux Security Advisory 2010-97            security@pardus.org.tr
------------------------------------------------------------------------
      Date: 2010-07-08
  Severity: 3
      Type: Local
------------------------------------------------------------------------

Summary
======
A denial of service vulnerability has been fixed in Avahi, which can be
used by malicious people to crash the server.


Description
==========
CVE-2010-2244:

Avahi crashes if it receives a bad packet (broken checksum) immediately
followed by a good packet. In that case FIONREAD returns zero size  for
the bad packet. avahi doesn't consider that an error

and calls recvmsg() which succeeds and returns the good packet which has
a non-zero length of course. This discrepancy causes an assert() to fail
and avahi terminates.


Affected packages:

  Pardus 2009:
    avahi, all before 0.6.25-16-4


Resolution
=========
There are update(s) for avahi. You can update them via Package  Manager
or with a single command from console:

    pisi up avahi

References
=========
  * http://bugs.pardus.org.tr/show_bug.cgi?id641

------------------------------------------------------------------------