New SLP Vulnerability Could Enable Massive DDoS Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-29552 | SLP DoS Amplification Flaw Affects VMware ESXi, SUSE Linux, NetApp CVE-2023-29552 is a protocol-level flaw in the IETF Service Location Protocol (SLP, RFC 2608) that permits an unauthenticated, remote attacker to register arbitrary services using spoofed UDP traffic sent to port 427. Any system running an SLP agent reachable on UDP 427 on an untrusted network can be abused as a reflector/amplifier, with reported amplification factors as high as roughly 2,200x, enabling large denial-of-service floods against third-party victims. The impact is availability only (CVSS 3.1: 7.5, A:H), and the attacker needs no privileges or user interaction. Affected parties include organizations running VMware ESXi, SUSE Linux Enterprise Server, or NetApp products (SMI-S Provider, Manager Server), as well as any host running the open-source Service Location Protocol implementation, since SLP is commonly enabled by default. The flaw was added to the CISA Known Exploited Vulnerabilities catalog on 2023-11-08 and is under active exploitation, with a high EPSS of 65.9% (99th percentile). Do: Per the CISA required action, disable the SLP service (slpd) where it is not needed, or restrict UDP port 427 to trusted management networks and never expose it to the internet. Apply the mitigations or patches issued in the VMware, SUSE, and NetApp advisories, and inventory all hosts listening on 427/UDP, prioritizing internet-facing and untrusted-network systems since the flaw is under active exploitation. | 7.5 | 66% | KEV PoC ×2 |
| masshundreds of thousands of servers or more plausibly run SLP enabled by default (exact count, and the number exposing UDP 427 to the internet, unknown) |
Full article414 words · extracted from infosecurity-magazine.com · click to collapse
Security researchers have discovered a high-severity vulnerability in the Service Location Protocol (SLP) which could be exploited to launch among the largest DDoS amplification attacks ever seen.
BitSight and Curesec said the CVSS 8.6-rated bug CVE-2023-29552 could enable attackers to launch reflective amplification attacks with a factor as high as 2200 times.
SLP was created in 1997 as a dynamic configuration mechanism for applications in local area networks, allowing systems on the same network to find and communicate with each other.
Although it was not designed to be made available on the public internet, the researchers found it running in over 2000 organizations and over 54,000 SLP-speaking instances globally, including on VMware ESXi hypervisors, Konica Minolta printers, Planex routers, IBM Integrated Management Modules (IMMs), SMC IPMI and more.
“Given the criticality of the vulnerability and the potential consequences resulting from exploitation, Bitsight coordinated public disclosure efforts with the US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) and impacted organizations,” the firm said.
“Bitsight also engaged with denial-of-service teams at major IT service management companies to help with remediation. CISA conducted extensive outreach to potentially impacted vendors.”
Read more on SLP threats: Legacy VMware Bug Exploited in Global Ransomware Campaign
The top three countries where SLP-speaking instances are running are the US, UK and Japan. To protect against CVE-2023-29552, researchers advised organizations to disable SLP on all systems running on untrusted networks, like those directly connected to the internet.
If they can’t do that, firewalls should be configured to filter traffic on UDP and TCP port 427 to prevent attackers from accessing SLP, it said.
Amplification attacks work by sending small requests to a server with a spoofed source IP address that matches the victim’s IP. The server replies to the victim’s IP with much larger responses than the requests, overwhelming that system.
When coupled with service registration, this kind of attack can be even more serious, BitSight explained.
“The typical reply packet size from an SLP server is between 48 and 350 bytes. Assuming a 29 byte request, the amplification factor – or the ratio of reply to request magnitudes – is roughly between 1.6X and 12X in this situation,” it said.
“However, SLP allows an unauthenticated user to register arbitrary new services, meaning an attacker can manipulate both the content and the size of the server reply, resulting in a maximum amplification factor of over 2200X due to the roughly 65,000 byte response given a 29 byte request.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/new-slp-vulnerability-massive-ddos/