Heap-based buffer overflow in OpenSLP - CVE-2017-17833

Vulnerability identifier: #VU13889

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-17833

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow. A remote unauthenticated attacker can trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

OpenSLP
FlashSystem 840 9840-AE1 & 9843-AE1
FlashSystem 900 9843-UF3
Integrated Management Module II (IMM2) for BladeCenter Systems
FlashSystem 900 9840-AE2 and 9843-AE2
FlashSystem 900 9840-AE3 and 9843-AE3
SAN Volume Controller and Storwize Family
Gentoo Linux
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux EUS Compute Node
Opensuse
Fedora
System x Integrated Management Module (IMM2)
Flex System Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)
openslp

Install update from vendor's website.

System x Integrated Management Module (IMM2) - update to 1AOO86D-7.00
Flex System Integrated Management Module (IMM2) - update to 1AOO86D-7.00
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO86D-7.00-bc
Flex System Chassis Management Module (CMM) - update to 2pet16d-2.5.13d
openslp - addressed in versions 2.0.0-15.fc27, 2.0.0-18.fc28
SAN Volume Controller and Storwize Family - addressed in versions 7.8.1.8, 8.1.3.4, 8.2.0.2, 8.2.1.0

• https://sourceforge.net/p/openslp/mercurial/ci/151f07745901cbdba6e00e4889561b4083250da1/

• Remote code execution in OpenSLP
• OpenSUSE Linux update for openslp
• Red Hat update for openslp
• Red Hat update for openslp
• OpenSUSE Linux update for openslp
• Red Hat update for openslp
• Gentoo update for OpenSLP
• Heap-based buffer overflow in IBM FlashSystem models 840 and 900
• Heap-based buffer overflow in IBM SAN Volume Controller and Storwize Family
• IBM Integrated Management Module II (IMM2) update for OpenSLP
• IBM Flex System Chassis Management Module (CMM) update for OpenSLP
• Fedora 28 update for openslp
• Fedora 27 update for openslp