CVE-2010-3609

2011-03-1100:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.371 Low

EPSS

Percentile

97.2%

JSON

The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other
versions before SVN revision 1647, as used in Service Location Protocol
daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote
attackers to cause a denial of service (infinite loop) via a packet with a
“next extension offset” that references this extension or a previous
extension. NOTE: some of these details are obtained from third party
information.

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchopenslp< 1.2.1-5ubuntu0.2UNKNOWN
ubuntu8.04noarchopenslp-dfsg< 1.2.1-7.1ubuntu0.2UNKNOWN
ubuntu9.10noarchopenslp-dfsg< 1.2.1-7.5ubuntu0.1UNKNOWN
ubuntu10.04noarchopenslp-dfsg< 1.2.1-7.6ubuntu0.1UNKNOWN
ubuntu10.10noarchopenslp-dfsg< 1.2.1-7.7ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	openslp	< 1.2.1-5ubuntu0.2	UNKNOWN
ubuntu	8.04	noarch	openslp-dfsg	< 1.2.1-7.1ubuntu0.2	UNKNOWN
ubuntu	9.10	noarch	openslp-dfsg	< 1.2.1-7.5ubuntu0.1	UNKNOWN
ubuntu	10.04	noarch	openslp-dfsg	< 1.2.1-7.6ubuntu0.1	UNKNOWN
ubuntu	10.10	noarch	openslp-dfsg	< 1.2.1-7.7ubuntu0.1	UNKNOWN