Vulnerability Note VU#393783

OpenSLP denial of service vulnerability

Original Release date: 21 Mar 2011 | Last revised: 21 Apr 2011


OpenSLP contains a vulnerability in the handling of packets containing malformed extensions, which can result in a denial-of-service condition.


Service Location Protocol is an IETF standards track protocol that provides a framework to allow networking applications to discover the existence, location, and configuration of networked services in enterprise networks. The OpenSLP project is an effort to develop an open-source implementation of Service Location Protocol. When OpenSLP parses a SLP packet containing malformed extensions the extensions parser will enter an infinite loop causing a denial-of-service condition.

If an attacker creates a packet containing a "next extension offset" pointing to itself or to a previous extension, the extension's parser will enter an infinite loop consuming 100% of the CPU.


A remote unauthenticated attacker may be able to create a denial-of-service condition.


Upgrade or apply a patch from the vendor

Patches and updated versions of the software have been released to address this issue. Please see the Vendor Information section of this document for more information.

Users who compile their OpenSLP software from the svn distribution should checkout to the latest svn revision. According to the revision update this vulnerability has been resolved in revision 1647.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Novell, Inc.Affected11 Aug 201014 Jan 2011
SUSE LinuxAffected07 Oct 201021 Mar 2011
UbuntuAffected-21 Apr 2011
VMwareAffected12 Aug 201016 Mar 2011
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A



Thanks to Nicolas Gregoire of Agarri for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

  • CVE IDs: CVE-2010-3609
  • Date Public: 21 Mar 2011
  • Date First Published: 21 Mar 2011
  • Date Last Updated: 21 Apr 2011
  • Severity Metric: 0.58
  • Document Revision: 22


If you have feedback, comments, or additional information about this vulnerability, please send us email.