CVE-2010-3609

Description

The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.

References

https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0227

https://security.gentoo.org/glsa/201707-05

https://exchange.xforce.ibmcloud.com/vulnerabilities/65931

http://www.vupen.com/english/advisories/2011/0729

http://www.vupen.com/english/advisories/2011/0606

http://www.vmware.com/security/advisories/VMSA-2011-0004.html

http://www.securityfocus.com/bid/46772

http://www.securityfocus.com/archive/1/516909/100/0/threaded

http://www.osvdb.org/71019

http://www.mandriva.com/security/advisories?name=MDVSA-2013:111

http://www.mandriva.com/security/advisories?name=MDVSA-2012:141

http://www.kb.cert.org/vuls/id/393783

http://securitytracker.com/id?1025168

http://securityreason.com/securityalert/8127

http://secunia.com/advisories/43742

http://secunia.com/advisories/43601

http://lists.vmware.com/pipermail/security-announce/2011/000126.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3