7.5

CVE-2023-29552

Warnung
Exploit
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netapp ≫ Smi-s Provider Version-
Suse ≫ Manager Server Version-
Suse ≫ Linux Enterprise Server Version11 Update-
Suse ≫ Linux Enterprise Server Version12 Update-
Suse ≫ Linux Enterprise Server Version12 Update- SwPlatformsap
Suse ≫ Linux Enterprise Server Version15 SwPlatform-
Suse ≫ Linux Enterprise Server Version15 SwPlatformsap
VMware ≫ ESXi Version < 7.0

08.11.2023: CISA Known Exploited Vulnerabilities (KEV) Catalog

Service Location Protocol (SLP) Denial-of-Service Vulnerability

Schwachstelle

The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.

Beschreibung

Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 65.87% 0.992
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html
Third Party Advisory
https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html
Third Party Advisory
Exploit
https://datatracker.ietf.org/doc/html/rfc2608
Technical Description
https://github.com/curesec/slpload
Product
https://security.netapp.com/advisory/ntap-20230426-0001/
Third Party Advisory
https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp
Third Party Advisory
Exploit
https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks
Third Party Advisory
US Government Resource
https://www.suse.com/support/kb/doc/?id=000021051
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552
US Government Resource