CVE-2010-3609
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision...
CVE-2010-3609 is a medium vulnerability (CVSS 5.0) in Openslp, published March 11, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 17.2%, the 97th percentile. No source names a fixed version.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 17.2%EPSS, 97th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openslp-dfsgDebian:6.0 From an advisory covering 3 CVEs | before 1.2.1-7.8+deb6u1, plus listed versions 1.2.1-7.8 | 1.2.1-7.8+deb6u1 |
openslpopenSUSE:Tumbleweed From an advisory covering 3 CVEs | before 2.0.0-8.1 | 2.0.0-8.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | OpenSLP 1.2.1 / < 1647 trunk - Denial of Service | 2011-08-05 |
What each source reports
NVD Score used
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
- Record
CVE-2010-3609- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE ListNo score
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
- Record
CVE-2010-3609- Updated
- 2026-11-02
EUVDEUVD-2010-3605No score
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
- Record
EUVD-2010-3605- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h733-hjhg-3p5jNo score
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision...
The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as used in Service Location Protocol daemon (SLPD) in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, allows remote attackers to cause a denial of service (infinite loop) via a packet with a "next extension offset" that references this extension or a previous extension. NOTE: some of these details are obtained from third party information.
- Record
GHSA-h733-hjhg-3p5j- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10065-1No score
openslp-2.0.0-8.1 on GA media
These are all security issues fixed in the openslp-2.0.0-8.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10065-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
kb.cert.org/vuls/id/393783
lists.vmware.com/pipermail/security-announce/2011/000126.html
wiki.mageia.org/en/Support/Advisories/MGASA-2012-0227
secunia.com/advisories/43742
osvdb.org/71019
vupen.com/english/advisories/2011/0606
Show 16 moreShow less
mandriva.com/security/advisories?name=MDVSA-2013:111
securityfocus.com/archive/1/516909/100/0/threaded
securityreason.com/securityalert/8127
securitytracker.com/id?1025168
security.gentoo.org/glsa/201707-05
exchange.xforce.ibmcloud.com/vulnerabilities/65931
vmware.com/security/advisories/VMSA-2011-0004.html
nvd.nist.gov/vuln/detail/CVE-2010-3609
github.com/advisories/GHSA-h733-hjhg-3p5j
suse.com/security/cve/CVE-2010-3609