The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openslp: memory corruption due to possible overflow in SLPFoldWhiteSpace in common/slp_compare.c     (CVE-2016-7567)

  - The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of     service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a     memory allocation failure. (CVE-2016-4912)

  - The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register     arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-     service attack with a significant amplification factor. (CVE-2023-29552)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - openslp: Reflective denial of service amplification attack via UDP (CVE-2023-29552)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote VMware ESXi host is less than version 7.0 and is affected by a reflected denial of service vulnerability:

  - The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary     services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a     significant amplification factor. (CVE-2023-29552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

リモート VMware ESXi ホストはバージョン 7.0 未満であり、反映されたサービス拒否脆弱性の影響を受けます。

  - Service Location Protocol (SLP、RFC 2608) により、認証されていないリモート攻撃者が任意のサービスを登録する可能性があります。これにより、攻撃者は、なりすまし UDP トラフィックを使用して、増幅率の大きいサービス拒否攻撃を仕掛ける可能性があります。(CVE-2023-29552)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

小於 7.0 版的遠端 VMware ESXi 主機受到反映式拒絕服務弱點影響：

  - 服務位置通訊協定 (SLP、RFC 2608) 允許未經驗證的遠端攻擊者註冊任意服務。這可允許攻擊者使用偽造的 UDP 流量，以重大的放大係數發動拒絕服務攻擊。(CVE-2023-29552)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 VMware ESXi 主机的版本小于 7.0，受到反射型拒绝服务漏洞影响：

  - 服务位置协议 (SLP, RFC 2608) 允许未经身份验证的远程攻击者注册任意服务。这可允许攻击者使用伪造的 UDP 流量进行具有显着放大系数的拒绝服务攻击。(CVE-2023-29552)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名稱	產品	系列	已發布	已更新	嚴重性
199030	RHEL 7 : openslp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical
199122	RHEL 9 : openslp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
176249	ESXi < 7.0 Reflected Denial of Service	Nessus	Misc.	2023/5/23	2023/11/9	high
176249	ESXi < 7.0 反映されたサービス拒否	Nessus	Misc.	2023/5/23	2023/11/9	high
176249	ESXi < 7.0 反映式拒絕服務	Nessus	Misc.	2023/5/23	2023/11/9	high
176249	ESXi < 7.0 反射型拒绝服务	Nessus	Misc.	2023/5/23	2023/11/9	high

偵測

搜尋 Plugin

critical

high

high

high

high

high