New SLP Vulnerability Could Enable Massive DDoS Attacks

Safety researchers have found a high-severity vulnerability within the Service Location Protocol (SLP) which could possibly be exploited to launch among the many largest DDoS amplification assaults ever seen.

BitSight and Curesec stated the CVSS 8.6-rated bug CVE-2023-29552 may allow attackers to launch reflective amplification assaults with an element as excessive as 2200 instances.

SLP was created in 1997 as a dynamic configuration mechanism for functions in native space networks, permitting programs on the identical community to search out and talk with one another.

Though it was not designed to be made accessible on the general public web, the researchers discovered it operating in over 2000 organizations and over 54,000 SLP-speaking situations globally, together with on VMware ESXi hypervisors, Konica Minolta printers, Planex routers, IBM Built-in Administration Modules (IMMs), SMC IPMI and extra.

“Given the criticality of the vulnerability and the potential penalties ensuing from exploitation, Bitsight coordinated public disclosure efforts with the US Division of Homeland Safety’s Cybersecurity and Infrastructure Safety Company (CISA) and impacted organizations,” the agency stated.

“Bitsight additionally engaged with denial-of-service groups at main IT service administration corporations to assist with remediation. CISA carried out intensive outreach to doubtlessly impacted distributors.”

Learn extra on SLP threats: Legacy VMware Bug Exploited in International Ransomware Marketing campaign

The highest three international locations the place SLP-speaking situations are operating are the US, UK and Japan. To guard towards CVE-2023-29552, researchers suggested organizations to disable SLP on all programs operating on untrusted networks, like these instantly related to the web.

If they will’t try this, firewalls needs to be configured to filter visitors on UDP and TCP port 427 to forestall attackers from accessing SLP, it stated.

Amplification assaults work by sending small requests to a server with a spoofed supply IP deal with that matches the sufferer’s IP. The server replies to the sufferer’s IP with a lot bigger responses than the requests, overwhelming that system.

When coupled with service registration, this sort of assault may be much more critical, BitSight defined.

“The standard reply packet measurement from an SLP server is between 48 and 350 bytes. Assuming a 29 byte request, the amplification issue – or the ratio of reply to request magnitudes – is roughly between 1.6X and 12X on this scenario,” it stated.

“Nevertheless, SLP permits an unauthenticated consumer to register arbitrary new providers, that means an attacker can manipulate each the content material and the scale of the server reply, leading to a most amplification issue of over 2200X as a result of roughly 65,000 byte response given a 29 byte request.”