CVE-2024-52615: Avahi: avahi wide-area dns uses constant source port
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
Other sources
This vulnerability exposes Avahi-daemon to potential DNS spoofing attacks by using a fixed source port for queries. However, the impact is limited because it only affects wide-area DNS and can be mitigated by forwarding queries to local DNS resolvers (e.g., systemd-resolved), which provide better randomization. The impact is primarily on systems actively using wide-area DNS, with .local mDNS being unaffected.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate by forwarding wide-area DNS queries to a local DNS resolver (e.g., systemd-resolved), since local resolvers provide better source-port randomization than Avahi wide-area DNS. Note: .local mDNS is unaffected.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52615?
CVE-2024-52615 is categorized as a medium severity vulnerability due to its potential for DNS spoofing attacks.
How do I fix CVE-2024-52615?
To mitigate CVE-2024-52615, you should update the Avahi-daemon to the latest version that addresses this vulnerability.
What systems are affected by CVE-2024-52615?
CVE-2024-52615 affects systems running the Avahi-daemon, particularly those using fixed source ports for wide-area DNS queries.
What kind of attack is CVE-2024-52615 associated with?
CVE-2024-52615 is associated with DNS spoofing attacks that exploit fixed source ports used by Avahi-daemon for DNS queries.
When was CVE-2024-52615 discovered?
CVE-2024-52615 was identified in early 2024, raising awareness of its implications for system security.