Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It is always recommended to disable Avahi daemon, for security reasons, when not in use.

So, by what ways it is possible to exploit a system which has avahi daemon service running? And how can we secure it?

share|improve this question

2 Answers 2

You can find some of the vulnerabilities displayed here. The problem with Avahi isn't that it's directly exploitable, but that it uses so called 'zero configuration protocol' or 'zeroconf' it will automatically detect printers, scanners and hosts (computer names) on the network. This can be a good thing for most normal users in a home LAN environment, but you do not want to have this enabled when you are connected to a wireless hotspot with tons of other people whom you don't know and therefor can't trust.

One of biggest problem with Avahi (well zeroconf in general for that matter) is that it uses multicast DNS rather than unicast DNS, making you even more susceptible to DNS spoofing attacks than normal.

share|improve this answer

Like Lucas said, the avahi-daemon isn't the problem per se; the problem is in what Avahi does. It advertises your hostname, your CPU architecture, your operating system type. It also advertises whether you're running SSH or not.

Granted, most of these information could be found out without Avahi, but there's really no reason to advertise them if you have no explicit reason. Personally, I disable Avahi on all of my Linux boxes.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.