CVE-2017-6519
Critical
Description
avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive information from the responding device via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809.
SeverityCritical
CVSS9.1
Exploit probability—
ProductAvahi
PublishedMay 1, 2017
First seenMay 1, 2017
Weakness typeCWE-346CWE-346
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| avahi avahi | v ≤ 0.6.32, 0.7 | — |
| canonical ubuntu_linux | 12.04, 14.04, 16.04, 18.04, 18.10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.