CVE-2017-17833

What it actually does

Heap-based memory corruption in OpenSLP that can result in denial-of-service or remote code execution when processing malformed SLP messages over the network.

Why it matters to the business

Affected systems may experience unexpected crashes or full remote compromise, disrupting services and potentially allowing attackers to execute arbitrary code without authentication.

How an attack unfolds

An attacker sends a crafted SLP packet to a vulnerable OpenSLP instance; the malformed input triggers heap corruption that can be leveraged for denial-of-service or to gain remote code execution.

How to fix it

Upgrade OpenSLP to a fixed release; for gnome/evince (GIT) apply commit f0ad6ef1749f9c67d582ccf88cbfdaf325f37ba7 or later. Disable SLP if not required and apply network segmentation as a temporary control.

How to confirm the fix worked

Confirm OpenSLP version is updated beyond 1.0.2/1.1.0 streams; test with known SLP fuzzing tools or review service logs for crashes on malformed input.

Typical attack path

1. Identify reachable OpenSLP service on UDP/TCP port 427
2. Send specially crafted SLP registration or query packets
3. Trigger heap memory corruption leading to crash or control-flow hijack
4. Achieve remote code execution or service denial

How to detect it

Review network logs and service logs for repeated malformed SLP packets or unexpected process crashes; look for connections on port 427 from untrusted sources.

What your security team should do

• Prioritize patching systems exposing OpenSLP to untrusted networks
• Disable SLP daemon where service discovery is unnecessary
• Monitor EPSS and threat intel for any increase in exploitation activity
• Apply network ACLs to restrict SLP traffic to trusted sources only