Local user can crash avahi-daemon with ServiceBrowserNew() call

[James Henstridge]

Binary package hint: avahi-daemon

Using avahi from feisty (0.6.17-0ubuntu2), I was able to crash the daemon by issuing the ServiceBrowserNew() D-BUS method call with the interface argument set to zero. I brought this up with one of the developers, who confirmed the bug and produced a fix for the problem:
    http://avahi.org/ticket/119

[James Henstridge (jamesh)]

Not just a Feisty bug: I could reproduce the crash on dapper (don't have any earlier installs to test).

[Martin Pitt (pitti)]

Patched upstream, will apply to Feisty soon.

Kees, I'm not entirely convinced that this is worth fixing in stables. What do you think?

[Trent Lloyd (lathiat)]

Well it's a 2 line fix, probably worth doing I guess.. it is a local DoS I guess its not *that* important, i.e. its not remote etc

[Kees Cook (kees)]

In this case, I don't think a local user DoS should cause a stable update. If there are future avahi updates, we should include this, though. But the fix should go into Feisty, since that's still open.

[Martin Pitt (pitti)]

 avahi (0.6.17-0ubuntu3) feisty; urgency=low
 .
   * debian/control: Add XS-Vcs-Bzr: header.
   * Add debian/patches/00upstream-ServiceBrowserNew-crash.patch: Fix local
     user crash DoS. Patch taken from upstream svn:
     http://avahi.org/changeset/1399. (LP: #95743)