Buffer overflow in the SLPFoldWhiteSpace function in common/slpcompare.c in OpenSLP 2.0 allows remote attackers to have unspecified impact via a crafted string.
Multiple buffer overflows in OpenSLP before 1.1.5 allow remote attackers to have an unknown impact via malformed SLP packets.
A null pointer dereference vulnerability was found in function xrealloc() in xlspxmalloc.c in OpenSLP. A remote attacker could potentially crash the server when large number of packets are sent.
Vulnerable code:
void xrealloc(const char file, int line, void ptr, sizet size) { xallocationt x;
if (!ptr) return xmalloc(file, line, size);
if (!size) { xfree(file, line, ptr); return 0; }
x = xmallocfind(ptr); if (x != 0) { void newptr = ptr; if (x->size != size) { newptr = xmalloc(file, line, size); // return 0 if failed from xmalloc memcpy(newptr, ptr, x->size); // it'll cased a null pointer reference xfree(file, line, x); } return newptr; }
if (Gxmallocfh) fprintf(Gxmallocfh, " xrealloc called on " "non-xmalloc'd memory \n");
return 0; }
A double free flaw was found in openslp's SLPDProcessMessage() function. A crafted package could cause openslp to crash.
This flaw only affects version 1.2.1 of openslp, which is only shipped in EPEL 5. Version 2.0.0 is not affected.
OpenSLP is not actively maintained upstream so patches are not available.
Acknowledgements:
Red Hat would like to thank Qinghao Tang of QIHU 360 for reporting this issue.
The extension parser in slpv2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
A null pointer dereference vulnerability was found in function xrealloc() in xlspxmalloc.c in OpenSLP. A remote attacker could potentially crash the server when large number of packets are sent.
Vulnerable code:
void xrealloc(const char file, int line, void ptr, sizet size) { xallocationt x;
if (!ptr) return xmalloc(file, line, size);
if (!size) { xfree(file, line, ptr); return 0; }
x = xmallocfind(ptr); if (x != 0) { void newptr = ptr; if (x->size != size) { newptr = xmalloc(file, line, size); // return 0 if failed from xmalloc memcpy(newptr, ptr, x->size); // it'll cased a null pointer reference xfree(file, line, x); } return newptr; }
if (Gxmallocfh) fprintf(Gxmallocfh, " xrealloc called on " "non-xmalloc'd memory \n");
return 0; }
A double free flaw was found in openslp's SLPDProcessMessage() function. A crafted package could cause openslp to crash.
This flaw only affects version 1.2.1 of openslp, which is only shipped in EPEL 5. Version 2.0.0 is not affected.
OpenSLP is not actively maintained upstream so patches are not available.
Acknowledgements:
Red Hat would like to thank Qinghao Tang of QIHU 360 for reporting this issue.
Symbolic link vulnerability in the slpd script slpd.allinit for OpenSLP before 1.0.11 allows local users to overwrite arbitrary files via the route.check temporary file.
A heap overflow vulnerability was found in openslp, that may result in remote code execution.