Predictable Seed in Pseudo-Random Number Generator (PRNG) in Avahi - CVE-2024-52616

Vulnerability identifier: #VU101681

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-52616

CWE-ID: CWE-337

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to software initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. A remote attacker can predict subsequent transaction IDs and perform DNS spoofing attack.

Avahi
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
openSUSE Leap Micro
Basesystem Module
Desktop Applications Module
SUSE Package Hub 15
openSUSE Leap
openEuler
SmartFabric Manager
Dell EMC VxRail Appliance
IBM API Connect
Business Automation Insights
avahi-debugsource
avahi
libavahi-glib1-32bit
libavahi-common3-32bit
avahi-glib2-debugsource
libavahi-common3-debuginfo-32bit
libdns_sd
avahi-utils-debuginfo
libdns_sd-debuginfo
libavahi-client3-32bit
libavahi-client3-debuginfo
avahi-utils
libavahi-glib1
libavahi-core7
avahi-debuginfo
libdns_sd-32bit
avahi-lang
libavahi-core7-debuginfo
libavahi-client3
avahi-debuginfo-32bit
libavahi-common3
libdns_sd-debuginfo-32bit
libavahi-client3-debuginfo-32bit
libavahi-common3-debuginfo
libavahi-glib1-debuginfo-32bit
libavahi-glib1-debuginfo
avahi-help
avahi-glib
avahi-autoipd
avahi-compat-howl
avahi-compat-howl-devel
avahi-compat-libdns_sd
avahi-compat-libdns_sd-devel
avahi-devel
avahi-dnsconfd
avahi-glib-devel
avahi-gobject
avahi-gobject-devel
avahi-libs
avahi-tools
avahi-ui
avahi-ui-devel
avahi-ui-gtk3
avahi-ui-tools
libavahi-gobject0-debuginfo
libavahi-gobject-devel
libavahi-glib-devel
avahi-autoipd-debuginfo
avahi-utils-gtk-debuginfo
libhowl0
avahi-qt5-debugsource
libavahi-qt5-devel
libavahi-ui-gtk3-0-debuginfo
libavahi-ui-gtk3-0
libhowl0-debuginfo
libavahi-common3-64bit-debuginfo
libavahi-glib1-32bit-debuginfo
libavahi-common3-32bit-debuginfo
libavahi-client3-32bit-debuginfo
avahi-32bit-debuginfo
libdns_sd-32bit-debuginfo
libavahi-devel
libavahi-client3-64bit
libavahi-client3-64bit-debuginfo
libdns_sd-64bit
libavahi-common3-64bit
libavahi-glib1-64bit-debuginfo
libdns_sd-64bit-debuginfo
libavahi-glib1-64bit
avahi-64bit-debuginfo
libavahi-libevent1
libavahi-gobject0
avahi-compat-mDNSResponder-devel
avahi-utils-gtk
python3-avahi
python3-avahi-gtk
libavahi-qt5-1
libavahi-libevent1-debuginfo
libavahi-qt5-1-debuginfo
typelib-1_0-Avahi-0_6
Red Hat OpenShift Dev Spaces
Red Hat Ceph Storage

Install update from vendor's website.

SmartFabric Manager - update to 1.2.0
Dell EMC VxRail Appliance - update to 8.321
IBM API Connect - update to 10.0.8.2 ifix2
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
avahi-debugsource - addressed in versions 0.6.32-32.30.1, 0.7-150100.3.40.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi - addressed in versions 0.6.32-32.30.1, 0.7-150100.3.40.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-glib1-32bit - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-common3-32bit - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-glib2-debugsource - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-common3-debuginfo-32bit - update to 0.6.32-32.30.1
libdns_sd - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-utils-debuginfo - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libdns_sd-debuginfo - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-client3-32bit - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-client3-debuginfo - addressed in versions 0.6.32-32.30.1, 0.7-150100.3.40.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-utils - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-glib1 - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-core7 - addressed in versions 0.6.32-32.30.1, 0.7-150100.3.40.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-debuginfo - addressed in versions 0.6.32-32.30.1, 0.7-150100.3.40.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libdns_sd-32bit - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-lang - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-core7-debuginfo - addressed in versions 0.6.32-32.30.1, 0.7-150100.3.40.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-client3 - addressed in versions 0.6.32-32.30.1, 0.7-150100.3.40.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-debuginfo-32bit - update to 0.6.32-32.30.1
libavahi-common3 - addressed in versions 0.6.32-32.30.1, 0.7-150100.3.40.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libdns_sd-debuginfo-32bit - update to 0.6.32-32.30.1
libavahi-client3-debuginfo-32bit - update to 0.6.32-32.30.1
libavahi-common3-debuginfo - addressed in versions 0.6.32-32.30.1, 0.7-150100.3.40.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-glib1-debuginfo-32bit - update to 0.6.32-32.30.1
libavahi-glib1-debuginfo - addressed in versions 0.6.32-32.30.1, 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-help - update to 0.8-24
avahi-glib - update to 0.8-24
avahi - update to 0.8-24
avahi-autoipd - update to 0.8-24
avahi-compat-howl - update to 0.8-24
avahi-compat-howl-devel - update to 0.8-24
avahi-compat-libdns_sd - update to 0.8-24
avahi-compat-libdns_sd-devel - update to 0.8-24
avahi-debuginfo - update to 0.8-24
avahi-debugsource - update to 0.8-24
avahi-devel - update to 0.8-24
avahi-dnsconfd - update to 0.8-24
avahi-glib-devel - update to 0.8-24
avahi-gobject - update to 0.8-24
avahi-gobject-devel - update to 0.8-24
avahi-libs - update to 0.8-24
avahi-tools - update to 0.8-24
avahi-ui - update to 0.8-24
avahi-ui-devel - update to 0.8-24
avahi-ui-gtk3 - update to 0.8-24
avahi-ui-tools - update to 0.8-24
libavahi-gobject0-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-gobject-devel - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-glib-devel - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-autoipd-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-utils-gtk-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libhowl0 - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-qt5-debugsource - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-qt5-devel - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-ui-gtk3-0-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-ui-gtk3-0 - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libhowl0-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-common3-64bit-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-glib1-32bit-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-common3-32bit-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-client3-32bit-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-32bit-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libdns_sd-32bit-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-devel - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-client3-64bit - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-client3-64bit-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libdns_sd-64bit - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-common3-64bit - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-glib1-64bit-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libdns_sd-64bit-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-glib1-64bit - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-64bit-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-libevent1 - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-gobject0 - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-autoipd - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-compat-howl-devel - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-compat-mDNSResponder-devel - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
avahi-utils-gtk - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
python3-avahi - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
python3-avahi-gtk - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-qt5-1 - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-libevent1-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
libavahi-qt5-1-debuginfo - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
typelib-1_0-Avahi-0_6 - addressed in versions 0.8-150400.7.20.1, 0.8-150600.15.6.1
Red Hat OpenShift Dev Spaces - update to 3.21.0
Red Hat Ceph Storage - update to 8.1

• https://bugzilla.redhat.com/show_bug.cgi?id=2326429
• https://github.com/avahi/avahi/security/advisories/GHSA-r9j3-vjjh-p8vm

• DNS spoofing attack in Avahi
• SUSE update for avahi
• SUSE update for avahi
• SUSE update for avahi
• SUSE update for avahi
• Dell SmartFabric Manager update for third-party components
• Dell VxRail Appliance 8.x update for third-party components
• Multiple vulnerabilities in IBM API Connect
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• Multiple vulnerabilities in IBM Business Automation Insights
• openEuler update for avahi
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces 3.21