Bugzilla – Bug 778508
VUL-1: CVE-2012-4428: openslp: Denial of Service (Application crash) due to out of bounds read
Last modified: 2020-04-02 02:25:19 UTC
Via private SECUNIA mail: We have confirmed the vulnerability in version 1.2.1. Details: --------- The vulnerability is caused due to an out-of-bounds read error within the "SLPIntersectStringList()" function (common/slp_compare.c) when processing service requests and can be exploited to cause a crash via a specially crafted request. --------- Please find the PoC attached. Please acknowledge receiving this e-mail and let us know when you expect to fix the vulnerability. Credits should go to: "Georgi Geshev via Secunia SVCRP". A copy of the Secunia Research Disclosure Policy can be located here: http://secunia.com/community/research/policy/
bugbot adjusting priority
Note: At the time of writing there is unfortunately no CRD available. We will update the bug once it has got a CRD or any other news. Thanks.
I have had a quick peek into it out of curiosity: itemend-1 is always '\\', regardless of 'itemend == listend' and '*itemend == ','', ie thus the break won't ever get executed whereas itemend gets increased by 1 every time the while(1) loop ends.
... which then results in out of bounds read access of 'itemend'.
Created attachment 505009 [details] -- openslp.bnc778508-openslp-out-of-bounds-read.patch One way (probably out of many others) to address this. Be aware: It might have its side effects if there is actual content behind '\\'.
Their propsed CRD is September 14, 2012
CVE-2012-4428
Public as per [1]. Small addition on c#6: It's the way upstream does it these days. [1] http://seclists.org/oss-sec/2012/q3/476
An update workflow for this issue was started. This issue was rated as low. Please submit fixed packages until 2015-04-08. https://swamp.suse.de/webswamp/wf/61070
Michael, we also had the fix for this bug in our planned updates list. Could you include it and resubmit? Thanks.
Sure, sorry for missing this.
released
SUSE-SU-2015:0922-1: An update that solves one vulnerability and has one errata is now available. Category: security (low) Bug References: 778508,855385 CVE References: CVE-2012-4428 Sources used: SUSE Linux Enterprise Software Development Kit 11 SP3 (src): openslp-1.2.0-172.24.1 SUSE Linux Enterprise Server 11 SP3 for VMware (src): openslp-1.2.0-172.24.1 SUSE Linux Enterprise Server 11 SP3 (src): openslp-1.2.0-172.24.1 SUSE Linux Enterprise Desktop 11 SP3 (src): openslp-1.2.0-172.24.1