CVE-2017-17833
Critical
Description
OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Openslp
PublishedApr 23, 2018
First seenApr 23, 2018
How to fix
Update
- lenovo flex_system_fc3171_8gb_san_switch_firmware9.1.13.02.00 or later
- lenovo storage_n3310_firmware4.53.351 or later
- lenovo storage_n4610_firmware4.53.351 or later
- lenovo bm_nextscale_fan_power_controller24p-2.15 or later
- lenovo cmm1.8.0 or later
- lenovo fan_power_controller30r-1.13 or later
- lenovo imm11.55 or later
- lenovo imm24.70 or later
- lenovo xclarity_administrator1.4.0 or later
- lenovo thinkserver_rd340_firmware50.00 or later
- lenovo thinkserver_rd350_firmware4.53.351 or later
- lenovo thinkserver_rd450_firmware4.53.351 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openslp openslp | 1.0.2, 1.1.0 | — |
| debian debian_linux | 7.0 | — |
| canonical ubuntu_linux | 14.04, 16.04 | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_server_aus | 7.6 | — |
| redhat enterprise_linux_server_eus | 7.5, 7.6 | — |
| redhat enterprise_linux_server_tus | 7.6 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
| lenovo thinkserver_rd350g_firmware | No range specified | — |
| lenovo thinkserver_rd350x_firmware | No range specified | — |
| lenovo thinkserver_rd450x_firmware | No range specified | — |
| lenovo thinksystem_hr630x_firmware | No range specified | — |
| lenovo thinksystem_hr650x_firmware | No range specified | — |
| lenovo thinksystem_sr630_firmware | No range specified | — |
| lenovo flex_system_fc3171_8gb_san_switch_firmware | v < 9.1.13.02.00 | 9.1.13.02.00 |
| lenovo storage_n3310_firmware | v < 4.53.351 | 4.53.351 |
| lenovo storage_n4610_firmware | v < 4.53.351 | 4.53.351 |
| lenovo bm_nextscale_fan_power_controller | v < 24p-2.15 | 24p-2.15 |
| lenovo cmm | v < 1.8.0 | 1.8.0 |
| lenovo fan_power_controller | v < 30r-1.13 | 30r-1.13 |
| lenovo imm1 | v < 1.55 | 1.55 |
| lenovo imm2 | v < 4.70 | 4.70 |
| lenovo xclarity_administrator | v < 1.4.0 | 1.4.0 |
| lenovo thinkserver_rd340_firmware | v < 50.00 | 50.00 |
| lenovo thinkserver_rd350_firmware | v < 4.53.351 | 4.53.351 |
| lenovo thinkserver_rd440_firmware | v ≤ 50.00 | — |
| lenovo thinkserver_rd450_firmware | v < 4.53.351 | 4.53.351 |
| lenovo thinkserver_rd550_firmware | v < 4.53.351 | 4.53.351 |
| lenovo thinkserver_rd540_firmware | v < 50.00 | 50.00 |
| lenovo thinkserver_rd640_firmware | v < 50.00 | 50.00 |
| lenovo thinkserver_rd650_firmware | v < 4.53.351 | 4.53.351 |
| lenovo thinkserver_rq750_firmware | v < 1.40 | 1.40 |
| lenovo thinkserver_rs160_firmware | v < 2.32 | 2.32 |
| lenovo thinkserver_sd350_firmware | No range specified | — |
| lenovo thinkserver_td340_firmware | v < 46.00 | 46.00 |
| lenovo thinkserver_td350_firmware | v < 4.53.351 | 4.53.351 |
| lenovo thinkserver_ts460_firmware | v < 2.32 | 2.32 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.