=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2011/VULN245
_____________________________________________________________________

DATE                      : 23/03/2011

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running OpenSLP implementations.

======================================================================
http://www.kb.cert.org/vuls/id/393783
______________________________________________________________________

Vulnerability Note VU#393783

OpenSLP denial of service vulnerability

Overview

OpenSLP contains a vulnerability in the handling of packets containing
malformed extensions, which can result in a denial-of-service condition.

I. Description

Service Location Protocol is an IETF standards track protocol that provides
a framework to allow networking applications to discover the existence,
location, and configuration of networked services in enterprise networks.
The OpenSLP project is an effort to develop an open-source implementation
of Service Location Protocol. When OpenSLP parses a SLP packet containing
malformed extensions the extensions parser will enter an infinite loop
causing a denial-of-service condition.

If an attacker creates a packet containing a "next extension offset"
pointing to itself or to a previous extension, the extension's parser
will enter an infinite loop consuming 100% of the CPU.


II. Impact

A remote unauthenticated attacker may be able to create a denial-of-service
condition.


III. Solution

Upgrade or apply a patch from the vendor

Patches and updated versions of the software have been released to address
this issue. Please see the Vendor Information section of this document for
more information.


Users who compile their OpenSLP software from the svn distribution should
checkout to the latest svn revision. According to the revision update this
vulnerability has been resolved in revision 1647.


Vendor Information

Vendor	Status	Date Notified	Date Updated
Novell, Inc.	Affected	2010-08-11	2011-01-14
SUSE Linux	Affected	2010-10-07	2011-03-21
VMware	Affected	2010-08-12	2011-03-16


References

http://openslp.svn.sourceforge.net/viewvc/openslp?view=revision&revision=1647
http://support.novell.com/security/cve/CVE-2010-3609.html
http://www.vmware.com/security/advisories/VMSA-2011-0004.html


Credit

Thanks to Nicolas Gregoire of Agarri for reporting this vulnerability.

This document was written by Michael Orlando.


Other Information
Date Public:	2011-03-21
Date First Published:	2011-03-21
Date Last Updated:	2011-03-21
CERT Advisory:	
CVE-ID(s):	CVE-2010-3609
NVD-ID(s):	CVE-2010-3609
US-CERT Technical Alerts:	
Severity Metric:	0,58
Document Revision:	21

If you have feedback, comments, or additional information about this
vulnerability, please send us email.

======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================