CVE-2021-26720

Name
CVE-2021-26720
Description
avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Product https://packages.debian.org/buster/avahi-daemon
Product https://packages.debian.org/sid/avahi-daemon
Broken Link https://metadata.ftp-master.debian.org/changelogs/main/a/avahi/avahi_0.8-4_changelog
Mailing List https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982796
Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=1180827
Third Party Advisory https://security-tracker.debian.org/tracker/CVE-2021-26720
Product https://packages.debian.org/bullseye/avahi-daemon
Issue Tracking https://bugs.launchpad.net/ubuntu/+source/avahi/+bug/1870824
Mailing List https://www.openwall.com/lists/oss-security/2021/02/15/2

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:avahi:avahi:*:*:*:*:*:*:*:* avahi >= None <= 0.8-4

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
avahi 3.10-main 0.7-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
avahi 3.11-main 0.7-r5 Natanael Copa <ncopa@alpinelinux.org> fixed
avahi 3.14-main 0.8-r5 Natanael Copa <ncopa@alpinelinux.org> fixed
avahi 3.13-main 0.8-r4 Natanael Copa <ncopa@alpinelinux.org> fixed
avahi 3.12-main 0.8-r4 Natanael Copa <ncopa@alpinelinux.org> fixed
avahi 3.15-main 0.8-r5 Natanael Copa <ncopa@alpinelinux.org> fixed
avahi 3.16-main 0.8-r6 Natanael Copa <ncopa@alpinelinux.org> fixed
avahi 3.17-main 0.8-r6 Natanael Copa <ncopa@alpinelinux.org> fixed
avahi 3.18-main 0.8-r13 Natanael Copa <ncopa@alpinelinux.org> fixed
avahi 3.19-main 0.8-r16 Natanael Copa <ncopa@alpinelinux.org> fixed
avahi 3.20-main 0.8-r17 Natanael Copa <ncopa@alpinelinux.org> fixed
avahi edge-main 0.8-r19 Natanael Copa <ncopa@alpinelinux.org> fixed