Veille CVE
CVE-2023-29552
7.5 Élevée Exploitée activementCatalogue CISA KEV — Service Location Protocol (SLP) Denial-of-Service Vulnerability
Ajoutée le 08/11/2023 · Échéance de correction (agences US) : 29/11/2023
Action requise : Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.
Description
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.5 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 7.5 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Références
- https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html Third Party Advisory
- https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html ExploitThird Party Advisory
- https://datatracker.ietf.org/doc/html/rfc2608 Technical Description
- https://github.com/curesec/slpload Product
- https://security.netapp.com/advisory/ntap-20230426-0001/ Third Party Advisory
- https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp ExploitThird Party Advisory
- https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks Third Party AdvisoryUS Government Resource
- https://www.suse.com/support/kb/doc/?id=000021051 Third Party Advisory
- https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html Third Party Advisory
- https://curesec.com/blog/article/CVE-2023-29552-Service-Location-Protocol-Denial-of-Service-Amplification-Attack-212.html ExploitThird Party Advisory
- https://datatracker.ietf.org/doc/html/rfc2608 Technical Description
- https://github.com/curesec/slpload Product
- https://security.netapp.com/advisory/ntap-20230426-0001/ Third Party Advisory
- https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp ExploitThird Party Advisory
- https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks Third Party AdvisoryUS Government Resource
- https://www.suse.com/support/kb/doc/?id=000021051 Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29552 US Government Resource