CVE-2010-3609: Medium severity CentOS OpenSLP Server vulnerability
The extension parser in slpv2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3609?
CVE-2010-3609 is considered a moderate severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2010-3609?
To fix CVE-2010-3609, users should upgrade to OpenSLP version 1.2.1 SVN revision 1647 or later, and ensure that VMware ESX and ESXi systems are updated to the latest versions.
What systems are affected by CVE-2010-3609?
CVE-2010-3609 affects OpenSLP versions before SVN revision 1647 and VMware ESX 4.0, 4.1 and ESXi 4.0, 4.1.
What type of attack does CVE-2010-3609 facilitate?
CVE-2010-3609 allows remote attackers to execute a denial-of-service attack by sending specially crafted packets.
Is CVE-2010-3609 still a threat to current systems?
CVE-2010-3609 is not a threat to current systems if they are updated beyond the vulnerable versions mentioned, but systems on outdated software remain at risk.