Description
ExtremeZ-IP.exe in ExtremeZ-IP File and Print Server 5.1.2x15 and earlier does not verify that a certain "number of URLs" field is consistent with the packet length, which allows remote attackers to cause a denial of service (daemon crash) via a large integer in this field in a packet to the Service Location Protocol (SLP) service on UDP port 427, triggering an out-of-bounds read.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Group Logic ExtremeZ-IP File and Print Servers 5.1.2 x15 - Multiple Vulnerabilities EDB-31132 · remote · Feb 10, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www.grouplogic.com/files/ez/hot/hotFix51.cfm
- 20080211 Multiple vulnerabilities in EztremeZ-IP File and Printer Server 5.1.2x15 mailing-list
- http://aluigi.altervista.org/adv/ezipirla-adv.txt
- 28862 third-party-advisory
- http://aluigi.org/poc/ezipirla.zip
- ADV-2008-0485 vdb-entry
- 27718 vdb-entry