Executive brief
OpenSLP is an open-source implementation of the Service Location Protocol, which helps devices discover services on a local network. A critical vulnerability in how the software handles whitespace in network messages allows a remote attacker to crash the service or potentially execute unauthorized code. This could lead to a complete takeover of the affected system or a disruption of network discovery services.
Technical details
A buffer overflow exists in the SLPFoldWhiteSpace function within common/slp_compare.c of OpenSLP 2.0.0. The vulnerability is caused by a lack of bounds checking in an inner while loop that processes whitespace characters; specifically, the pointer 'p' can increment beyond the end-of-buffer pointer 'ep'. When this occurs, a subsequent memmove() call receives a very large size_t value calculated from (ep - p), leading to a massive memory corruption. A remote, unauthenticated attacker can trigger this by sending a specially crafted SLP message (such as a Service Type Request) over the network. A patch was committed to the SourceForge repository in late 2015, but reports indicate some 2.0.0 distributions remained vulnerable long after.
Affected products
- OpenSLP OpenSLP 2.0.0
Timeline
- 2015-12-01: patched: Fix committed to SourceForge repository
- 2016-09-27: disclosed: Public disclosure on oss-security mailing list
- 2017-01-23: advisory: NVD publication date
References
- http://www.openwall.com/lists/oss-security/2016/09/27/4
- http://www.openwall.com/lists/oss-security/2016/09/28/1
- http://www.securityfocus.com/bid/93186
- https://security.gentoo.org/glsa/201707-05
- https://sourceforge.net/p/openslp/mercurial/ci/34fb3aa5e6b4997fa21cb614e480de36da5dbc9a/
- https://www.exploit-db.com/exploits/45804/