New SLP Vulnerability Could Enable Massive DDoS Attacks

From infosecurity-magazine.com

Security researchers have discovered a high-severity vulnerability in the Service Location Protocol (SLP) which could be exploited to launch among the largest DDoS amplification attacks ever seen.

BitSight and Curesec said the CVSS 8.6-rated bug CVE-2023-29552 could enable attackers to launch reflective amplification attacks with a factor as high as 2200 times.

SLP was created in 1997 as a dynamic configuration mechanism for applications in local area networks, allowing systems on the same network to find and communicate with each other.

Although it was not designed to be made available on the public internet, the researchers found it running in over 2000 organizations and over 54,000 SLP-speaking instances globally, including on VMware ESXi hypervisors, Konica Minolta printers, Planex routers, IBM Integrated Management Modules (IMMs), SMC IPMI and more.

“Given the criticality of the vulnerability and the potential consequences resulting from exploitation, Bitsight coordinated public disclosure efforts with the US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) and impacted organizations,” the firm said.

Read more…