fkie_cve-2010-3609
Vulnerability from fkie_nvd
Published
2011-03-11 17:55
Modified
2024-11-21 01:19
Severity ?
Summary
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
References
cret@cert.orghttp://lists.vmware.com/pipermail/security-announce/2011/000126.html
cret@cert.orghttp://secunia.com/advisories/43601Vendor Advisory
cret@cert.orghttp://secunia.com/advisories/43742Vendor Advisory
cret@cert.orghttp://securityreason.com/securityalert/8127
cret@cert.orghttp://securitytracker.com/id?1025168
cret@cert.orghttp://www.kb.cert.org/vuls/id/393783US Government Resource
cret@cert.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2012:141
cret@cert.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2013:111
cret@cert.orghttp://www.osvdb.org/71019
cret@cert.orghttp://www.securityfocus.com/archive/1/516909/100/0/threaded
cret@cert.orghttp://www.securityfocus.com/bid/46772
cret@cert.orghttp://www.vmware.com/security/advisories/VMSA-2011-0004.htmlVendor Advisory
cret@cert.orghttp://www.vupen.com/english/advisories/2011/0606Vendor Advisory
cret@cert.orghttp://www.vupen.com/english/advisories/2011/0729Vendor Advisory
cret@cert.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/65931
cret@cert.orghttps://security.gentoo.org/glsa/201707-05
cret@cert.orghttps://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0227
af854a3a-2127-422b-91ae-364da2661108http://lists.vmware.com/pipermail/security-announce/2011/000126.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43601Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/43742Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8127
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1025168
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/393783US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2012:141
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2013:111
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/71019
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/516909/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/46772
af854a3a-2127-422b-91ae-364da2661108http://www.vmware.com/security/advisories/VMSA-2011-0004.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0606Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0729Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/65931
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201707-05
af854a3a-2127-422b-91ae-364da2661108https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0227
Impacted products
Vendor Product Version
openslp openslp 1.2.1
vmware esx 4.0
vmware esx 4.1
vmware esxi 4.0
vmware esxi 4.1


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:openslp:openslp:1.2.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "2759B9FB-9B05-4137-9C90-02D7CDBB692D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:vmware:esx:4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "889DE9BE-886F-4BEF-A794-5B5DE73D2322",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:vmware:esx:4.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "4D3C6FC4-DAE3-42DB-B845-593BBD2A50BF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:vmware:esxi:4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "6BDAA7C8-8F2F-4037-A517-2C1EDB70B203",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:vmware:esxi:4.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "73C9E205-87EE-4CE2-A252-DED7BB6D4EAE",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a \"next extension offset\" that references this extension or a previous extension.  NOTE: some of these details are obtained from third party information.",
      },
      {
         lang: "es",
         value: "El analizador de extensiones en el archivo slp_v2message.c en OpenSLP versión 1.2.1 y  otras versiones anteriores a la revisión SVN 1647, como es usado en demonio de Service Location Protocol (SLPD) en ESX versiones 4.0 y 4.1 y ESXi versiones 4.0 y 4.1 de VMware, permite a los atacantes remotos causar una denegación de servicio (bucle infinito) por medio de un paquete con un  \"next extension offset\" que hace referencia a esta extensión o una extensión previa. NOTA: algunos de estos detalles son obtenidos a partir de información de terceros.",
      },
   ],
   id: "CVE-2010-3609",
   lastModified: "2024-11-21T01:19:13.610",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2011-03-11T17:55:02.617",
   references: [
      {
         source: "cret@cert.org",
         url: "http://lists.vmware.com/pipermail/security-announce/2011/000126.html",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/43601",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/43742",
      },
      {
         source: "cret@cert.org",
         url: "http://securityreason.com/securityalert/8127",
      },
      {
         source: "cret@cert.org",
         url: "http://securitytracker.com/id?1025168",
      },
      {
         source: "cret@cert.org",
         tags: [
            "US Government Resource",
         ],
         url: "http://www.kb.cert.org/vuls/id/393783",
      },
      {
         source: "cret@cert.org",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2012:141",
      },
      {
         source: "cret@cert.org",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2013:111",
      },
      {
         source: "cret@cert.org",
         url: "http://www.osvdb.org/71019",
      },
      {
         source: "cret@cert.org",
         url: "http://www.securityfocus.com/archive/1/516909/100/0/threaded",
      },
      {
         source: "cret@cert.org",
         url: "http://www.securityfocus.com/bid/46772",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.vmware.com/security/advisories/VMSA-2011-0004.html",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2011/0606",
      },
      {
         source: "cret@cert.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2011/0729",
      },
      {
         source: "cret@cert.org",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/65931",
      },
      {
         source: "cret@cert.org",
         url: "https://security.gentoo.org/glsa/201707-05",
      },
      {
         source: "cret@cert.org",
         url: "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0227",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.vmware.com/pipermail/security-announce/2011/000126.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/43601",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://secunia.com/advisories/43742",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://securityreason.com/securityalert/8127",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://securitytracker.com/id?1025168",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "US Government Resource",
         ],
         url: "http://www.kb.cert.org/vuls/id/393783",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2012:141",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.mandriva.com/security/advisories?name=MDVSA-2013:111",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.osvdb.org/71019",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/archive/1/516909/100/0/threaded",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/46772",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.vmware.com/security/advisories/VMSA-2011-0004.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2011/0606",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://www.vupen.com/english/advisories/2011/0729",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/65931",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.gentoo.org/glsa/201707-05",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0227",
      },
   ],
   sourceIdentifier: "cret@cert.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-noinfo",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.