CVE-2012-4428 – CVE-2012-4428 is a buffer overflow vulnerabilit... (How to Fix)

Q: What is the severity of CVE-2012-4428?

CVE-2012-4428 has a CVSS score of 7.5 (HIGH). CVE-2012-4428 is a buffer overflow vulnerability in the SLPIntersectStringList() function of OpenSLP that can cause denial of service. Attackers can crash the OpenSLP service by sending specially crafted Service Location Protocol packets. Systems running vulnerable versions of OpenSLP are affected.

📋 TL;DR

CVE-2012-4428 is a buffer overflow vulnerability in the SLPIntersectStringList() function of OpenSLP that can cause denial of service. Attackers can crash the OpenSLP service by sending specially crafted Service Location Protocol packets. Systems running vulnerable versions of OpenSLP are affected.

💻 Affected Systems

Products:

OpenSLP

Versions: Versions prior to 2.0.0

Operating Systems: Linux distributions including Fedora, Ubuntu, Red Hat Enterprise Linux

Default Config Vulnerable: ⚠️ Yes

Notes: Systems with OpenSLP enabled and listening on port 427 are vulnerable. Some distributions may not enable OpenSLP by default.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete denial of service of the OpenSLP service, potentially disrupting network service discovery and affecting dependent applications.

🟠

Likely Case

Service crash requiring manual restart, causing temporary disruption to service discovery functionality.

🟢

If Mitigated

Minimal impact with proper network segmentation and access controls limiting SLP traffic.

🌐 Internet-Facing: MEDIUM - Requires SLP port (427) to be exposed and accessible from untrusted networks.

🏢 Internal Only: LOW - Internal attackers could disrupt service discovery but typically requires network access to SLP service.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploit requires network access to OpenSLP service port (427). Proof of concept code has been publicly available since 2012.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: OpenSLP 2.0.0 and later

Vendor Advisory: https://access.redhat.com/security/cve/cve-2012-4428

Restart Required: Yes

Instructions:

1. Update OpenSLP to version 2.0.0 or later using your distribution's package manager. 2. For RHEL/CentOS: yum update openslp. 3. For Ubuntu/Debian: apt-get update && apt-get install openslp. 4. Restart the OpenSLP service or reboot the system.

🔧 Temporary Workarounds

Disable OpenSLP Service

linux

Stop and disable the OpenSLP service if not required

systemctl stop slpd
systemctl disable slpd

Block SLP Port with Firewall

linux

Block access to SLP port 427/tcp and 427/udp

iptables -A INPUT -p tcp --dport 427 -j DROP
iptables -A INPUT -p udp --dport 427 -j DROP

🧯 If You Can't Patch

Implement network segmentation to restrict access to OpenSLP service
Use host-based firewalls to block incoming connections to port 427

🔍 How to Verify

Check if Vulnerable:

Check OpenSLP version: slptool -v or rpm -q openslp or dpkg -l openslp

Check Version:

slptool -v 2>/dev/null || openslp -v 2>/dev/null || rpm -q openslp || dpkg -l openslp | grep openslp

Verify Fix Applied:

Verify OpenSLP version is 2.0.0 or higher and service is running without crashes

📡 Detection & Monitoring

Log Indicators:

OpenSLP service crashes in system logs
Segmentation fault errors related to slpd process

Network Indicators:

Unusual traffic to port 427/tcp or 427/udp
Malformed SLP packets

SIEM Query:

process:slpd AND (event_type:crash OR signal:SIGSEGV)

📊 Metadata

CVE ID: CVE-2012-4428

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-125

Published: December 2, 2019

Last Updated: November 21, 2024

🔗 References

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159059.html Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/09/13/27 Mailing List,Third Party Advisory
http://www.securityfocus.com/bid/55540 Third Party Advisory,VDB Entry
http://www.ubuntu.com/usn/USN-2730-1 Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-4428 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4428 Issue Tracking,Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2012-4428 Issue Tracking,Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/78732 Third Party Advisory,VDB Entry
https://security-tracker.debian.org/tracker/CVE-2012-4428 Third Party Advisory
https://security.gentoo.org/glsa/201707-05 Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159059.html Mailing List,Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/09/13/27 Mailing List,Third Party Advisory
http://www.securityfocus.com/bid/55540 Third Party Advisory,VDB Entry
http://www.ubuntu.com/usn/USN-2730-1 Third Party Advisory
https://access.redhat.com/security/cve/cve-2012-4428 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4428 Issue Tracking,Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2012-4428 Issue Tracking,Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/78732 Third Party Advisory,VDB Entry
https://security-tracker.debian.org/tracker/CVE-2012-4428 Third Party Advisory
https://security.gentoo.org/glsa/201707-05 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2012-4428, you might also want to check these: