New SLP Vulnerability Could Let Attackers Launch 2200x Powerful DDoS Attacks

Abstract: 

A vulnerability in the Service Learning Protocol (SLP) could be used by malicious actors to launch a high-scale DDoS attack, with amplification of approximately 2200x. This vulnerability can affect multiple organizations around the world, with products such as VMWare ESXi Hypervisor, Konica Minolta printers, and Planex Routers, and countries such as the U.S., the U.K., Japan, Germany, and Canada being most vulnerable. SLP is used by computers and other devices to identify other services within a local area network, such as printers, file servers, and other network devices. Until a solution is found, users are recommended to disable SLP on any system connected to the internet, or filter traffic on UDP/TCP port 427. While no attacks have used this exploit, Cloudflare stated in an advisory that they "expects the prevalence of SLP-based DDoS attacks to rise significantly in the coming weeks." Additionally, VMWare has determined that ESXi 7.x and 8.x are not impacted by this vulnerability, and this issue only exists in older versions that are not supported.

Author: 

Ravie Lakshmanan

Year: 

2023

Domain: 

Dimension: 

Region: 

Data Type: 

Keywords: