CVE-2010-3609 - CVE House
Back to Database
Status published Medium CVE-2010-3609

The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other...

Vulnerability Description

The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2010-3609

Credits & Attribution

No credits recorded in the NVD database.

References

More from openslp

View All →
CVE-2017-17833
OpenSLP releases in the 1.0.2 and 1.1.0 code streams have...
Critical 9.8
CVE-2016-7567
Buffer overflow in the SLPFoldWhiteSpace function in common/slp_compare.c in OpenSLP...
Critical 9.8
CVE-2016-4912
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote...
High 7.5
CVE-2015-5177
Double free vulnerability in the SLPDKnownDAAdd function in slpd/slpd_knownda.c in...
High 7.5
CVE-2005-0769
Multiple buffer overflows in OpenSLP before 1.1.5 allow remote attackers...
High 7.5

Affected Vendor

Affected Software

openslp, esx, esxi
Vulnerable Versions:
1.2.1, 4.0, 4.1

Timeline

Official Publish: March 11th, 2011
Last Modified: August 7th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.