Double free vulnerability in the SLPDKnownDAAdd function in slpd/slpd_knownda.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service (crash) via a crafted package.

The remote VMware ESXi host is version 5.5 prior to build 3029944. It is, therefore, affected by a remote code execution vulnerability due to a double-free error in the SLPDProcessMessage() function in OpenSLP. An unauthenticated, remote attacker can exploit this, via a crafted package, to execute arbitrary code or cause a denial of service condition.

The remote VMware ESXi host is version 5.1 prior to build 3021178. It is, therefore, affected by a remote code execution vulnerability due to a double-free error in the SLPDProcessMessage() function in OpenSLP. An unauthenticated, remote attacker can exploit this, via a crafted package, to execute arbitrary code or cause a denial of service condition.

The remote VMware ESXi host is version 5.0 prior to build 3021432. It is, therefore, affected by a remote code execution vulnerability due to a double-free error in the SLPDProcessMessage() function in OpenSLP. An unauthenticated, remote attacker can exploit this, via a crafted package, to execute arbitrary code or cause a denial of service condition.

The remote VMware ESXi host is affected by a remote code execution vulnerability due to a double-free error in the SLPDProcessMessage() function in OpenSLP. An unauthenticated, remote attacker can exploit this, via a crafted package, to execute arbitrary code or cause a denial of service condition.

Qinghao Tang of QIHU 360 discovered a double free flaw in OpenSLP, an implementation of the IETF Service Location Protocol. This could allow remote attackers to cause a denial of service (crash).

Georgi Geshev discovered that OpenSLP incorrectly handled processing certain service requests. A remote attacker could possibly use this issue to cause OpenSLP to crash, resulting in a denial of service.
This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
(CVE-2012-4428)

Qinghao Tang discovered that OpenSLP incorrectly handled processing certain messages. A remote attacker could possibly use this issue to cause OpenSLP to crash, resulting in a denial of service.
(CVE-2015-5177).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues have been found and solved in OpenSLP, that implements the Internet Engineering Task Force (IETF) Service Location Protocol standards protocol.

CVE-2010-3609

Remote attackers could cause a Denial of Service in the Service Location Protocol daemon (SLPD) via a crafted packet with a 'next extension offset'.

CVE-2012-4428

Georgi Geshev discovered that an out-of-bounds read error in the SLPIntersectStringList() function could be used to cause a DoS.

CVE-2015-5177

A double free in the SLPDProcessMessage() function could be used to cause openslp to crash.

For Debian 6 'Squeeze', these problems have been fixed in openslp-dfsg version 1.2.1-7.8+deb6u1.

We recommend that you upgrade your openslp-dfsg packages.

Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
86947	VMware ESXi 5.5 < Build 3029944 OpenSLP RCE (VMSA-2015-0007)	Nessus	Misc.	high
86946	VMware ESXi 5.1 < Build 3021178 OpenSLP RCE (VMSA-2015-0007)	Nessus	Misc.	high
86945	VMware ESXi 5.0 < Build 3021432 OpenSLP RCE (VMSA-2015-0007)	Nessus	Misc.	high
86254	VMSA-2015-0007 : VMware vCenter and ESXi updates address critical security issues	Nessus	VMware ESX Local Security Checks	high
85810	Debian DSA-3353-1 : openslp-dfsg - security update	Nessus	Debian Local Security Checks	high
85798	Ubuntu 14.04 LTS : OpenSLP vulnerabilities (USN-2730-1)	Nessus	Ubuntu Local Security Checks	high
85769	Debian DLA-304-1 : openslp-dfsg security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-5177

high

Tenable Plugins

high

high

high

high

high

high

high