CVE-2010-3609
En bref
- Source
- NVD
- EPSS
- EPSS 17.22 % · centile 97 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- certcc
- Statut NVD
- Modified
Description
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
Références
- http://www.kb.cert.org/vuls/id/393783
- http://lists.vmware.com/pipermail/security-announce/2011/000126.html
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0227
- http://secunia.com/advisories/43742
- http://www.osvdb.org/71019
- http://www.vupen.com/english/advisories/2011/0606
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:111
- http://www.securityfocus.com/archive/1/516909/100/0/threaded
- http://securityreason.com/securityalert/8127
- http://securitytracker.com/id?1025168
- https://security.gentoo.org/glsa/201707-05
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65931
- http://www.vupen.com/english/advisories/2011/0729
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:141
- http://www.securityfocus.com/bid/46772
- http://secunia.com/advisories/43601
- http://www.vmware.com/security/advisories/VMSA-2011-0004.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2010-3605
- GCVE · GCVE-0-2010-3609
Avis du CERT-FR
- CERTA-2011-AVI-143 — Multiples vulnérabilités dans VMware ESX/ESXi · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:openslp:openslp:1.2.1:*:*:*:*:*:*:*cpe:2.3:a:vmware:esx:4.0:*:*:*:*:*:*:*cpe:2.3:a:vmware:esx:4.1:*:*:*:*:*:*:*cpe:2.3:a:vmware:esxi:4.0:*:*:*:*:*:*:*cpe:2.3:a:vmware:esxi:4.1:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |