CVE-2019-5544

CVSS 9.8 CRITICALEPSS 96.8%● KEVCWE-787

In short

OpenSLP software used in ESXi and Horizon DaaS appliances has a flaw that allows attackers to overwrite memory on the heap, potentially taking complete control of the system. This is critical because it can lead to unauthorized access and data theft.

Technical detail

A heap buffer overflow in OpenSLP (CWE-787) allows remote attackers to overwrite adjacent heap memory without authentication. The vulnerability enables arbitrary code execution with the privileges of the affected service, impacting confidentiality, integrity, and availability of ESXi and Horizon DaaS systems.

Summary generated and translated by AI from the official description.

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · ESXi and Horizon DaaS

public PoCs found — 2

githubgithub.com/dgh05t/VMware_ESXI_OpenSLP_PoCs★ 67 githubgithub.com/HynekPetrak/CVE-2019-5544_CVE-2020-3992★ 49

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://access.redhat.com/errata/RHSA-2019:4240 https://access.redhat.com/errata/RHSA-2020:0199 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA3LYAJ2NRKMOZLZOQNDJ5TNQRFMWGHF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZPXXJZLPLAQULBCJVI5NNWZ3PGWXGXWG/https://security.gentoo.org/glsa/202005-12 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5544 http://www.openwall.com/lists/oss-security/2019/12/10/2 http://www.openwall.com/lists/oss-security/2019/12/11/2 http://www.vmware.com/security/advisories/VMSA-2019-0022.html