Bug 1777788 (CVE-2019-5544) - CVE-2019-5544 openslp: Heap-based buffer overflow in ProcessSrvRqst() in slpd_process.c leading to remote code execution
Summary: CVE-2019-5544 openslp: Heap-based buffer overflow in ProcessSrvRqst() in slpd...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-5544
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1781702 1781703 1780754 1781701 1788447
Blocks: 1777792
TreeView+ depends on / blocked
 
Reported: 2019-11-28 10:39 UTC by Marian Rehak
Modified: 2020-02-05 23:19 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Needed
Clone Of:
Environment:
Last Closed: 2019-12-16 14:09:30 UTC


Attachments (Terms of Use)
Patch openslp 1.2.0 (7.40 KB, patch)
2019-11-28 10:42 UTC, Marian Rehak
no flags Details | Diff
Patch openslp 2.0.0 (6.14 KB, patch)
2019-11-28 10:44 UTC, Marian Rehak
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:4240 None None None 2019-12-16 10:04:40 UTC
Red Hat Product Errata RHSA-2020:0199 None None None 2020-01-22 12:28:00 UTC

Description Marian Rehak 2019-11-28 10:39:59 UTC
A heap overflow vulnerability was found in openslp, that may result in remote code execution.

Comment 1 Marian Rehak 2019-11-28 10:42:49 UTC
Created attachment 1640334 [details]
Patch openslp 1.2.0

Comment 2 Marian Rehak 2019-11-28 10:44:00 UTC
Created attachment 1640335 [details]
Patch openslp 2.0.0

Comment 6 Riccardo Schirone 2019-12-10 10:06:49 UTC
External References:

https://www.vmware.com/security/advisories/VMSA-2019-0022.html

Comment 9 Riccardo Schirone 2019-12-10 12:24:26 UTC
The `result` buffer in function ProcessSrvRqst() in file slpd/slpd_process.c is reallocated after computing the expected `size`. However, the size is computed using the `urllen` fields from each SLPUrlEntry, while the memcpy in that same function may use the `opaquelen` of the SLPUrlEntry, which could be bigger than the urllen and result in a heap-based buffer overflow. This could result in a crash or in code execution.

Comment 10 Riccardo Schirone 2019-12-10 12:28:45 UTC
Statement:

This issue did not affect the versions of openslp as shipped with Red Hat Enterprise Linux 8 as they did not include the slpd service component.

Comment 11 Riccardo Schirone 2019-12-10 12:29:21 UTC
Mitigation:

There is no known mitigation.

Comment 16 Riccardo Schirone 2019-12-12 14:39:36 UTC
The URL entries parsed by ProcessSrvRqst() are the ones registered by a service during a SrvReg message, which is used to register a new service. An unauthenticated attacker on the LAN can register a new service with specially crafted URLs that, when parsed during a SrvRqst message - generally used to discover existing services - may trigger the flaw and cause an heap-based buffer overflow, leading to a crash or remote code execution.

Comment 17 errata-xmlrpc 2019-12-16 10:04:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:4240 https://access.redhat.com/errata/RHSA-2019:4240

Comment 18 Product Security DevOps Team 2019-12-16 14:09:30 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-5544

Comment 20 errata-xmlrpc 2020-01-22 12:27:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2020:0199 https://access.redhat.com/errata/RHSA-2020:0199


Note You need to log in before you can comment on or make changes to this bug.