Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2021-3468 |
CWE-ID | CWE-835 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software |
SUSE Manager Proxy Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE CaaS Platform Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system avahi-lang Operating systems & Components / Operating system package or component libavahi-common3-32bit-debuginfo Operating systems & Components / Operating system package or component libavahi-common3-32bit Operating systems & Components / Operating system package or component libavahi-client3-32bit-debuginfo Operating systems & Components / Operating system package or component libavahi-client3-32bit Operating systems & Components / Operating system package or component avahi-32bit-debuginfo Operating systems & Components / Operating system package or component typelib-1_0-Avahi-0_6 Operating systems & Components / Operating system package or component libhowl0-debuginfo Operating systems & Components / Operating system package or component libhowl0 Operating systems & Components / Operating system package or component libdns_sd-debuginfo Operating systems & Components / Operating system package or component libdns_sd Operating systems & Components / Operating system package or component libavahi-ui0-debuginfo Operating systems & Components / Operating system package or component libavahi-ui0 Operating systems & Components / Operating system package or component libavahi-ui-gtk3-0-debuginfo Operating systems & Components / Operating system package or component libavahi-ui-gtk3-0 Operating systems & Components / Operating system package or component libavahi-gobject0-debuginfo Operating systems & Components / Operating system package or component libavahi-gobject0 Operating systems & Components / Operating system package or component libavahi-glib1-debuginfo Operating systems & Components / Operating system package or component libavahi-glib1 Operating systems & Components / Operating system package or component libavahi-glib-devel Operating systems & Components / Operating system package or component libavahi-devel Operating systems & Components / Operating system package or component libavahi-core7-debuginfo Operating systems & Components / Operating system package or component libavahi-core7 Operating systems & Components / Operating system package or component libavahi-common3-debuginfo Operating systems & Components / Operating system package or component libavahi-common3 Operating systems & Components / Operating system package or component libavahi-client3-debuginfo Operating systems & Components / Operating system package or component libavahi-client3 Operating systems & Components / Operating system package or component avahi-utils-debuginfo Operating systems & Components / Operating system package or component avahi-utils Operating systems & Components / Operating system package or component avahi-compat-mDNSResponder-devel Operating systems & Components / Operating system package or component avahi-compat-howl-devel Operating systems & Components / Operating system package or component avahi Operating systems & Components / Operating system package or component libavahi-gobject-devel Operating systems & Components / Operating system package or component avahi-utils-gtk-debuginfo Operating systems & Components / Operating system package or component avahi-utils-gtk Operating systems & Components / Operating system package or component avahi-glib2-debugsource Operating systems & Components / Operating system package or component avahi-autoipd-debuginfo Operating systems & Components / Operating system package or component avahi-autoipd Operating systems & Components / Operating system package or component avahi-debugsource Operating systems & Components / Operating system package or component avahi-debuginfo Operating systems & Components / Operating system package or component |
Vendor | SUSE |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU79113
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-3468
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work() function. A local user can consume all available system resources and cause denial of service conditions.
MitigationUpdate the affected package avahi to the latest version.
Vulnerable software versionsSUSE Manager Proxy: 4.0
SUSE Manager Retail Branch Server: 4.0
SUSE Manager Server: 4.0
SUSE Linux Enterprise Server for SAP: 15-SP1
SUSE Linux Enterprise High Performance Computing: 15-SP1-LTSS - 15-SP1-ESPOS
SUSE Enterprise Storage: 6
SUSE CaaS Platform: 4.0
SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP1-LTSS
avahi-lang: before 0.7-3.9.1
libavahi-common3-32bit-debuginfo: before 0.7-3.9.1
libavahi-common3-32bit: before 0.7-3.9.1
libavahi-client3-32bit-debuginfo: before 0.7-3.9.1
libavahi-client3-32bit: before 0.7-3.9.1
avahi-32bit-debuginfo: before 0.7-3.9.1
typelib-1_0-Avahi-0_6: before 0.7-3.9.1
libhowl0-debuginfo: before 0.7-3.9.1
libhowl0: before 0.7-3.9.1
libdns_sd-debuginfo: before 0.7-3.9.1
libdns_sd: before 0.7-3.9.1
libavahi-ui0-debuginfo: before 0.7-3.9.1
libavahi-ui0: before 0.7-3.9.1
libavahi-ui-gtk3-0-debuginfo: before 0.7-3.9.1
libavahi-ui-gtk3-0: before 0.7-3.9.1
libavahi-gobject0-debuginfo: before 0.7-3.9.1
libavahi-gobject0: before 0.7-3.9.1
libavahi-glib1-debuginfo: before 0.7-3.9.1
libavahi-glib1: before 0.7-3.9.1
libavahi-glib-devel: before 0.7-3.9.1
libavahi-devel: before 0.7-3.9.1
libavahi-core7-debuginfo: before 0.7-3.9.1
libavahi-core7: before 0.7-3.9.1
libavahi-common3-debuginfo: before 0.7-3.9.1
libavahi-common3: before 0.7-3.9.1
libavahi-client3-debuginfo: before 0.7-3.9.1
libavahi-client3: before 0.7-3.9.1
avahi-utils-debuginfo: before 0.7-3.9.1
avahi-utils: before 0.7-3.9.1
avahi-compat-mDNSResponder-devel: before 0.7-3.9.1
avahi-compat-howl-devel: before 0.7-3.9.1
avahi: before 0.7-3.9.1
libavahi-gobject-devel: before 0.7-3.9.1
avahi-utils-gtk-debuginfo: before 0.7-3.9.1
avahi-utils-gtk: before 0.7-3.9.1
avahi-glib2-debugsource: before 0.7-3.9.1
avahi-autoipd-debuginfo: before 0.7-3.9.1
avahi-autoipd: before 0.7-3.9.1
avahi-debugsource: before 0.7-3.9.1
avahi-debuginfo: before 0.7-3.9.1
CPE2.3https://www.suse.com/support/update/announcement/2021/suse-su-20211493-2/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.