CVE-2024-52615

What it actually does

Avahi-daemon relies on fixed source ports for wide-area DNS queries, allowing predictable responses that simplify injection of malicious DNS data.

Why it matters to the business

Systems face increased risk of DNS response injection leading to traffic redirection or resolution failures; low and stable EPSS suggests limited active exploitation but still requires attention on affected deployments.

How an attack unfolds

An attacker monitors DNS traffic, predicts the fixed source port used by the daemon, and sends forged responses to poison queries before legitimate answers arrive.

How to fix it

Upgrade affected packages to the listed fixed versions such as flashplugin-nonfree (Ubuntu:14.04:LTS) at 11.2.202.569ubuntu0.14.04.1; configure randomized source ports where supported.

How to confirm the fix worked

Verify package versions match the fixed releases and test DNS query source ports for randomization after updates.

Typical attack path

1. Locate systems running Avahi-daemon performing wide-area DNS lookups
2. Observe or predict fixed source ports in queries
3. Craft and time malicious DNS responses for injection
4. Achieve cache poisoning or spoofed resolutions

How to detect it

Review DNS query logs for repeated source ports from the daemon and inspect for anomalous response timings or unexpected resolutions.

What your security team should do

• Prioritize patching systems with the provided fixed package versions due to the published date over 690 days ago
• Audit configurations for fixed port usage in DNS services
• Monitor EPSS and threat intelligence for any rise in exploitation