CVE-2017-17833

CVSS V2 High 7.5 CVSS V3 Critical 9.8
Description
OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.
Overview
  • CVE ID
  • CVE-2017-17833
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2018-04-23T18:29:00
  • Last Modified Date
  • 2020-05-15T00:15:11
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:a:openslp:openslp:1.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:openslp:openslp:1.1.0:*:*:*:*:*:*:* 1 OR
AND
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* 1 OR
AND
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* 1 OR
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* 1 OR
AND
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* 1 OR
AND
cpe:2.3:o:lenovo:thinkserver_rd350g_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:thinkserver_rd350g:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_rd350x_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:thinkserver_rd350x:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_rd450x_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:thinkserver_rd450x:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinksystem_hr630x_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:thinksystem_hr630x:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinksystem_hr650x_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:thinksystem_hr650x:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinksystem_sr630_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:thinksystem_sr630:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:flex_system_fc3171_8gb_san_switch_firmware:*:*:*:*:*:*:*:* 1 OR 9.1.13.02.00
cpe:2.3:h:lenovo:flex_system_fc3171_8gb_san_switch:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:storage_n3310_firmware:*:*:*:*:*:*:*:* 1 OR 4.53.351
cpe:2.3:h:lenovo:storage_n3310:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:storage_n4610_firmware:*:*:*:*:*:*:*:* 1 OR 4.53.351
cpe:2.3:h:lenovo:storage_n4610:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:a:lenovo:bm_nextscale_fan_power_controller:*:*:*:*:*:*:*:* 1 OR 24p-2.15
cpe:2.3:a:lenovo:cmm:*:*:*:*:*:*:*:* 1 OR 1.8.0
cpe:2.3:a:lenovo:fan_power_controller:*:*:*:*:*:*:*:* 1 OR 30r-1.13
cpe:2.3:a:lenovo:imm1:*:*:*:*:*:*:*:* 1 OR 1.55
cpe:2.3:a:lenovo:imm2:*:*:*:*:*:*:*:* 1 OR 4.70
cpe:2.3:a:lenovo:xclarity_administrator:*:*:*:*:*:*:*:* 1 OR 1.4.0
AND
cpe:2.3:o:lenovo:thinkserver_rd340_firmware:*:*:*:*:*:*:*:* 1 OR 50.00
cpe:2.3:h:lenovo:thinkserver_rd340:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_rd350_firmware:*:*:*:*:*:*:*:* 1 OR 4.53.351
cpe:2.3:h:lenovo:thinkserver_rd350:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_rd440_firmware:*:*:*:*:*:*:*:* 1 OR 50.00
cpe:2.3:h:lenovo:thinkserver_rd440:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_rd450_firmware:*:*:*:*:*:*:*:* 1 OR 4.53.351
cpe:2.3:h:lenovo:thinkserver_rd450:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_rd550_firmware:*:*:*:*:*:*:*:* 1 OR 4.53.351
cpe:2.3:h:lenovo:thinkserver_rd550:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_rd540_firmware:*:*:*:*:*:*:*:* 1 OR 50.00
cpe:2.3:h:lenovo:thinkserver_rd540:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_rd640_firmware:*:*:*:*:*:*:*:* 1 OR 50.00
cpe:2.3:h:lenovo:thinkserver_rd640:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_rd650_firmware:*:*:*:*:*:*:*:* 1 OR 4.53.351
cpe:2.3:h:lenovo:thinkserver_rd650:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_rq750_firmware:*:*:*:*:*:*:*:* 1 OR 1.40
cpe:2.3:h:lenovo:thinkserver_rq750:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_rs160_firmware:*:*:*:*:*:*:*:* 1 OR 2.32
cpe:2.3:h:lenovo:thinkserver_rs160:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_sd350_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:lenovo:thinkserver_sd350:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_td340_firmware:*:*:*:*:*:*:*:* 1 OR 46.00
cpe:2.3:h:lenovo:thinkserver_td340:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_td350_firmware:*:*:*:*:*:*:*:* 1 OR 4.53.351
cpe:2.3:h:lenovo:thinkserver_td350:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:lenovo:thinkserver_ts460_firmware:*:*:*:*:*:*:*:* 1 OR 2.32
cpe:2.3:h:lenovo:thinkserver_ts460:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:P/I:P/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 7.5
  • Severity
  • HIGH
  • Exploitability Score
  • 10
  • Impact Score
  • 6.4
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 9.8
  • Base Severity
  • CRITICAL
  • Exploitability Score
  • 3.9
  • Impact Score
  • 5.9
References
Reference URL Reference Tags
https://sourceforge.net/p/openslp/mercurial/ci/151f07745901cbdba6e00e4889561b4083250da1/ Patch Third Party Advisory
http://support.lenovo.com/us/en/solutions/LEN-18247 Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/04/msg00029.html Issue Tracking Mailing List Third Party Advisory
https://usn.ubuntu.com/3708-1/ Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2240 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2308 Third Party Advisory
https://security.gentoo.org/glsa/202005-12
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2017-17833
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17833
History
Created Old Value New Value Data Type Notes
2022-05-10 17:32:11 Added to TrackCVE
2022-12-03 05:31:55 2018-04-23T18:29Z 2018-04-23T18:29:00 CVE Published Date updated
2022-12-03 05:31:55 2020-05-15T00:15:11 CVE Modified Date updated
2022-12-03 05:31:55 Modified Vulnerability Status updated