CVE-2012-4428

What it actually does

The SLPIntersectStringList function in OpenSLP contains a memory corruption flaw that can be triggered by malformed SLP service requests, resulting in a crash or resource exhaustion that denies service to legitimate clients.

Why it matters to the business

Organizations relying on SLP for service discovery may experience unplanned outages or degraded availability of networked services until the affected process is restarted or the system is patched.

How an attack unfolds

An attacker sends a specially crafted SLP packet containing malformed string lists to an OpenSLP listener; the vulnerable intersection function processes the input without proper bounds checking, corrupting memory and causing the daemon to terminate or hang.

How to fix it

Upgrade OpenSLP to a version containing the fix for this memory handling issue; if no patched package is available for the distribution, disable SLP or apply vendor-supplied workarounds such as input filtering at the network level.

How to confirm the fix worked

Confirm the installed OpenSLP version is newer than the vulnerable release, review process stability under simulated SLP traffic, and verify that malformed requests no longer cause crashes.

Typical attack path

1. Identify hosts exposing SLP on UDP/TCP port 427
2. Craft and transmit a malicious SLP service request targeting SLPIntersectStringList
3. Observe service crash or resource exhaustion confirming successful denial of service
4. Repeat as needed to maintain disruption

How to detect it

Review system and application logs for repeated SLP daemon crashes or segmentation faults around the time of suspected incidents; correlate with network flows to port 427.

What your security team should do

• Prioritize patching OpenSLP on all exposed systems given the remote unauthenticated attack vector
• Monitor for SLP-related crashes in system logs and implement network segmentation to limit SLP exposure
• Consider disabling SLP where service discovery is not required