CVE-2010-3609
published 2011-03-11CVE-2010-3609: The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in…
PriorityP333medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
17.22%
96.8th percentile
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openslp | openslp | — | — |
| vmware | esx | — | — |
| vmware | esx | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | vmware_esxi | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_vsphere | — | — |
| vmware | vmware_workstation | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openslp: Packet with crafted "nextoffset" and "extid" values causes DoS
vendor_redhat·2015-09-16·CVSS 5.0
CVE-2015-5155 [MEDIUM] openslp: Packet with crafted "nextoffset" and "extid" values causes DoS
openslp: Packet with crafted "nextoffset" and "extid" values causes DoS
[REJECTED CVE] A vulnerability has been identified in Openslp in ParseExtension() function in slp_message.c file. Attacker can force the function to enter the infinte loop causing denial of service via packet with crafted "nextoffset" value and "extid" value.
Statement: This flaw was found to be a duplicate of CVE-2010-3609. Please see https://access.redhat.com/security/cve/CVE-2010-3609 for information about affected products and security errata.
Package: openslp (Red Hat Enterprise Linux 6) - Not affected
Package: openslp (Red Hat Enterprise Linux 7) - Not affected
Ubuntu
OpenSLP vulnerability
vendor_ubuntu·2011-04-20
CVE-2010-3609 OpenSLP vulnerability
Title: OpenSLP vulnerability
Summary: An attacker could send crafted input to OpenSLP and cause it to hang.
It was discovered that OpenSLP incorrectly handled certain corrupted
messages. A remote attacker could send a specially crafted packet to
the OpenSLP server and cause it to hang, leading to a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
VMware
VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm.
vendor_vmware·2011-03-07·CVSS 5.0
CVE-2010-2059 [MEDIUM] VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm.
VMSA-2011-0004: VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm.
a. Service Location Protocol daemon DoS This patch fixes a denial-of-service vulnerability in the Service Location Protocol daemon (SLPD). Exploitation of this vulnerability could cause SLPD to consume significant CPU resources. VMware would like to thank Nicolas Gregoire and US CERT for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-3609 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product ============= Product Version ======= Running on ======= Replace with/
GHSA
GHSA-h733-hjhg-3p5j: The extension parser in slp_v2message
ghsa_unreviewed·2022-05-14
CVE-2010-3609 [MEDIUM] GHSA-h733-hjhg-3p5j: The extension parser in slp_v2message
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
No detection rules found.
Bugzilla
CVE-2015-5155 openslp: Packet with crafted "nextoffset" and "extid" values causes DoS
bugzilla·2015-09-16·CVSS 5.0
CVE-2015-5155 [MEDIUM] CVE-2015-5155 openslp: Packet with crafted "nextoffset" and "extid" values causes DoS
CVE-2015-5155 openslp: Packet with crafted "nextoffset" and "extid" values causes DoS
A vulnerability in ParseExtension() function in openslp was reported. Attacker can force the function to enter the infinte loop causing denial of service via packet with crafted "nextoffset" value and "extid" value.
Vulnerable code in openslp-1.2.1/common/slp_message.c:
int ParseExtension(SLPBuffer buffer, SLPMessage message)
/* Parse extensions *after* all standard protocol fields are parsed
*/
/*--------------------------------------------------------------------------*/
{
int extid;
int nextoffset;
int result = SLP_ERROR_OK;
extoffset = message->header.extoffset;
while(nextoffset)
{
//here,buffer->start value is stable ,and we can
control nextoffset,so we can control buffer->curpos
buffer->curpo
Bugzilla
CVE-2010-3609 openslp: denial of service vulnerability [epel-5]
bugzilla·2011-07-13·CVSS 5.0
CVE-2010-3609 [MEDIUM] CVE-2010-3609 openslp: denial of service vulnerability [epel-5]
CVE-2010-3609 openslp: denial of service vulnerability [epel-5]
epel-5 tracking bug for openslp: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes
in the 'blocks' bugs.
[bug automatically created by: add-tracking-bugs]
Discussion:
The Fedora clone of this flaw went unfixed and closed automatically. Is there a plan to fix this in el5?
---
openslp-1.2.1-21.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/openslp-1.2.1-21.el5
---
Package openslp-1.2.1-21.el5:
* should fix your issue,
* was pushed to the Fedora EPEL 5 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-tes
Bugzilla
CVE-2010-3609 openslp: denial of service vulnerability [fedora-all]
bugzilla·2011-07-13·CVSS 5.0
CVE-2010-3609 [MEDIUM] CVE-2010-3609 openslp: denial of service vulnerability [fedora-all]
CVE-2010-3609 openslp: denial of service vulnerability [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=684294
Please note: this issue affects multiple suppor
Bugzilla
CVE-2010-3609 openslp: denial of service vulnerability
bugzilla·2011-03-11·CVSS 5.0
CVE-2010-3609 [MEDIUM] CVE-2010-3609 openslp: denial of service vulnerability
CVE-2010-3609 openslp: denial of service vulnerability
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-3609 to
the following vulnerability:
Name: CVE-2010-3609
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3609
Assigned: 20100927
Reference: http://www.securityfocus.com/archive/1/archive/1/516909/100/0/threaded
Reference: http://lists.vmware.com/pipermail/security-announce/2011/000126.html
Reference: http://www.vmware.com/security/advisories/VMSA-2011-0004.html
Reference: http://www.securityfocus.com/bid/46772
Reference: http://www.osvdb.org/71019
Reference: http://securitytracker.com/id?1025168
Reference: http://secunia.com/advisories/43601
Reference: http://www.vupen.com/english/advisories/2011/0606
Reference: http://xforce.iss.net/xforce/xfdb/65931
U
http://lists.vmware.com/pipermail/security-announce/2011/000126.htmlhttp://secunia.com/advisories/43601http://secunia.com/advisories/43742http://securityreason.com/securityalert/8127http://securitytracker.com/id?1025168http://www.kb.cert.org/vuls/id/393783http://www.mandriva.com/security/advisories?name=MDVSA-2012:141http://www.mandriva.com/security/advisories?name=MDVSA-2013:111http://www.osvdb.org/71019http://www.securityfocus.com/archive/1/516909/100/0/threadedhttp://www.securityfocus.com/bid/46772http://www.vmware.com/security/advisories/VMSA-2011-0004.htmlhttp://www.vupen.com/english/advisories/2011/0606http://www.vupen.com/english/advisories/2011/0729https://exchange.xforce.ibmcloud.com/vulnerabilities/65931https://security.gentoo.org/glsa/201707-05https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0227http://lists.vmware.com/pipermail/security-announce/2011/000126.htmlhttp://secunia.com/advisories/43601http://secunia.com/advisories/43742http://securityreason.com/securityalert/8127http://securitytracker.com/id?1025168http://www.kb.cert.org/vuls/id/393783http://www.mandriva.com/security/advisories?name=MDVSA-2012:141http://www.mandriva.com/security/advisories?name=MDVSA-2013:111http://www.osvdb.org/71019http://www.securityfocus.com/archive/1/516909/100/0/threadedhttp://www.securityfocus.com/bid/46772http://www.vmware.com/security/advisories/VMSA-2011-0004.htmlhttp://www.vupen.com/english/advisories/2011/0606http://www.vupen.com/english/advisories/2011/0729https://exchange.xforce.ibmcloud.com/vulnerabilities/65931https://security.gentoo.org/glsa/201707-05https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0227
2011-03-11
Published