CVE-2010-3609: openslp
Vulnerability summary
CVE-2010-3609 is a medium (CVSS 5.0) vulnerability in openslp. EPSS estimates a 17.22% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Duplicates 1 · Related 1Timeline
- 11-03-2011PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
17.22%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 17.22% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOpenSLP 1.2.1 / < 1647 trunk - Denial of Service
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
2 vendors · 3 products
References
17 links- wiki.mageia.org/en/Support/Advisories/MGASA-2012-0227X Refsource CONFIRM