OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

The version of openslp installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-5544 advisory.

  - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated     the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.16.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16.1 advisory.

  - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated     the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

  - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root configuration, and USER= logging, for a sudo -u     \#$((0xffffffff)) command. (CVE-2019-14287)

  - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly     sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox     < 68, and Thunderbird < 60.8. (CVE-2019-11729)

  - When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the     block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and     Firefox < 71. (CVE-2019-11745)

  - An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain error case is mishandled. (CVE-2018-20856)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.11.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.3 advisory.

  - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated     the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

  - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell     WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a     denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the     availability of the system. If code execution occurs, the code will run with the permissions of root. This     will affect both confidentiality and integrity of files on the system. (CVE-2019-14901)

  - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root configuration, and USER= logging, for a sudo -u     \#$((0xffffffff)) command. (CVE-2019-14287)

  - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly     sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox     < 68, and Thunderbird < 60.8. (CVE-2019-11729)

  - When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the     block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and     Firefox < 71. (CVE-2019-11745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.16.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16.0.1 advisory.

  - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated     the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

  - A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the     mwifiex kernel module while connecting to a malicious wireless network. (CVE-2019-3846)

  - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly     sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox     < 68, and Thunderbird < 60.8. (CVE-2019-11729)

  - When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the     block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and     Firefox < 71. (CVE-2019-11745)

  - An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain error case is mishandled. (CVE-2018-20856)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.17. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.17 advisory.

  - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell     WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a     denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the     availability of the system. If code execution occurs, the code will run with the permissions of root. This     will affect both confidentiality and integrity of files on the system. (CVE-2019-14901)

  - libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. (CVE-2020-5312)

  - An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the     library can either allocate very large amounts of memory or take an extremely long period of time to     process the image. (CVE-2019-16865)

  - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly     sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox     < 68, and Thunderbird < 60.8. (CVE-2019-11729)

  - When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the     block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and     Firefox < 71. (CVE-2019-11745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4919-1 advisory.

    It was discovered that OpenSLP did not properly validate URLs. A remote attacker could use this issue to     cause OpenSLP to crash or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the openslp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - OpenSLP as used in ESXi and the Horizon DaaS appliances     has a heap overwrite issue. VMware has evaluated the     severity of this issue to be in the Critical severity     range with a maximum CVSSv3 base score of     9.8.(CVE-2019-5544)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202005-12 (OpenSLP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSLP. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote NewStart CGSL host, running version MAIN 4.05, has openslp packages installed that are affected by a vulnerability:

  - OpenSLP as used in ESXi and the Horizon DaaS appliances     has a heap overwrite issue. VMware has evaluated the     severity of this issue to be in the Critical severity     range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0199 advisory.

  - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated     the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-0199 advisory.

    [2.0.0-4]
    - Fix a heap-based buffer overflow vulnerability leading to       remote code execution, CVE-2019-5544       Resolves: #1788447

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - openslp: Heap-based buffer overflow in ProcessSrvRqst()     in slpd_process.c leading to remote code execution     (CVE-2019-5544)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0199 advisory.

    OpenSLP is an open source implementation of the Service Location Protocol (SLP) which is an Internet     Engineering Task Force (IETF) standards track protocol and provides a framework to allow networking     applications to discover the existence, location, and configuration of networked services in enterprise     networks.

    Security Fix(es):

    * openslp: Heap-based buffer overflow in ProcessSrvRqst() in slpd_process.c leading to remote code     execution (CVE-2019-5544)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has openslp packages installed that are affected by a vulnerability:

  - OpenSLP as used in ESXi and the Horizon DaaS appliances     has a heap overwrite issue. VMware has evaluated the     severity of this issue to be in the Critical severity     range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openslp packages installed that are affected by a vulnerability:

  - OpenSLP as used in ESXi and the Horizon DaaS appliances     has a heap overwrite issue. VMware has evaluated the     severity of this issue to be in the Critical severity     range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for openslp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSLP is an open source implementation of the Service Location Protocol (SLP) which is an Internet Engineering Task Force (IETF) standards track protocol and provides a framework to allow networking applications to discover the existence, location, and configuration of networked services in enterprise networks.

Security Fix(es) :

* openslp: Heap-based buffer overflow in ProcessSrvRqst() in slpd_process.c leading to remote code execution (CVE-2019-5544)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A heap-based buffer overflow was discovered in OpenSLP in the way the slpd service processes URLs in service request messages. A remote unauthenticated attacker could register a service with a specially crafted URL that, when used during a service request message, would trigger the flaw and cause the program to crash or to remotely execute code with the privileges of the slpd service.(CVE-2019-5544)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:4240 advisory.

    OpenSLP is an open source implementation of the Service Location Protocol (SLP) which is an Internet     Engineering Task Force (IETF) standards track protocol and provides a framework to allow networking     applications to discover the existence, location, and configuration of networked services in enterprise     networks.

    Security Fix(es):

    * openslp: Heap-based buffer overflow in ProcessSrvRqst() in slpd_process.c leading to remote code     execution (CVE-2019-5544)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4240 advisory.

    [1:2.0.0-8]
    - Fix a heap-based buffer overflow vulnerability leading to       remote code execution, CVE-2019-5544       Resolves: #1781701

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2019-5544

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

VMware ESXi updates address OpenSLP remote code execution vulnerability (CVE-2019-5544)

OpenSLP as used in ESXi has a heap overwrite issue. A malicious actor with network access to port 427 on an ESXi host may be able to overwrite the heap of the OpenSLP service resulting in remote code execution.

ID	Name	Product	Family	Severity
201753	CBL Mariner 2.0 Security Update: openslp (CVE-2019-5544)	Nessus	MarinerOS Local Security Checks	critical
164695	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16.1)	Nessus	Misc.	critical
164602	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.3)	Nessus	Misc.	critical
164593	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16.0.1)	Nessus	Misc.	critical
164561	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17)	Nessus	Misc.	critical
148810	Ubuntu 16.04 LTS : OpenSLP vulnerability (USN-4919-1)	Nessus	Ubuntu Local Security Checks	critical
137497	EulerOS 2.0 SP2 : openslp (EulerOS-SA-2020-1655)	Nessus	Huawei Local Security Checks	critical
136642	GLSA-202005-12 : OpenSLP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
135764	NewStart CGSL MAIN 4.05 : openslp Vulnerability (NS-SA-2020-0015)	Nessus	NewStart CGSL Local Security Checks	critical
135547	EulerOS 2.0 SP3 : openslp (EulerOS-SA-2020-1418)	Nessus	Huawei Local Security Checks	critical
133921	EulerOS 2.0 SP5 : openslp (EulerOS-SA-2020-1120)	Nessus	Huawei Local Security Checks	critical
133314	CentOS 6 : openslp (RHSA-2020:0199)	Nessus	CentOS Local Security Checks	critical
133220	Oracle Linux 6 : openslp (ELSA-2020-0199)	Nessus	Oracle Linux Local Security Checks	critical
133196	Scientific Linux Security Update : openslp on SL6.x i386/x86_64 (20200122)	Nessus	Scientific Linux Local Security Checks	critical
133188	RHEL 6 : openslp (RHSA-2020:0199)	Nessus	Red Hat Local Security Checks	critical
133086	NewStart CGSL CORE 5.05 / MAIN 5.05 : openslp Vulnerability (NS-SA-2020-0001)	Nessus	NewStart CGSL Local Security Checks	critical
132631	EulerOS 2.0 SP8 : openslp (EulerOS-SA-2020-1038)	Nessus	Huawei Local Security Checks	critical
132464	NewStart CGSL CORE 5.04 / MAIN 5.04 : openslp Vulnerability (NS-SA-2019-0260)	Nessus	NewStart CGSL Local Security Checks	critical
132402	CentOS 7 : openslp (CESA-2019:4240)	Nessus	CentOS Local Security Checks	critical
132266	Amazon Linux 2 : openslp (ALAS-2019-1378)	Nessus	Amazon Linux Local Security Checks	critical
132229	RHEL 7 : openslp (RHSA-2019:4240)	Nessus	Red Hat Local Security Checks	critical
132221	Oracle Linux 7 : openslp (ELSA-2019-4240)	Nessus	Oracle Linux Local Security Checks	critical
132115	Fedora 30 : openslp (2019-86bceb61b3)	Nessus	Fedora Local Security Checks	critical
132112	Fedora 31 : openslp (2019-1e5ae33e87)	Nessus	Fedora Local Security Checks	critical
132085	Scientific Linux Security Update : openslp on SL7.x x86_64 (20191216)	Nessus	Scientific Linux Local Security Checks	critical
132017	VMSA-2019-0022 : VMware ESXi updates address OpenSLP remote code execution vulnerability	Nessus	VMware ESX Local Security Checks	critical

Detections

Analytics

CVE-2019-5544

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical