Vulnerability · high
sblim-sfcb pre-auth denial of service disclosed
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Servers running SBLIM SFCB with the CIM-XML service
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Remote, no login
The Brief
- Espilon VR reported a remote, pre-authentication denial-of-service defect in the CIM-XML request parser of SBLIM SFCB.
- The flaw is an unbounded quoted-attribute scan in cimXmlParser.c getValue, and it has a latent, weak out-of-bounds NUL write side effect.
- The report was made through coordinated disclosure to the MITRE CNA and the sblim-sfcb distribution security teams.
Why it matters
An SFCB CIM server reachable over the network can be crashed by an unauthenticated request, so operators of exposed CIM-XML endpoints should treat it as a service-availability risk.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: SFCB is a CIM management broker run by ops/IT teams on Linux servers. |
| No | Core infrastructure | Judgment: a single niche CIM broker, not software nearly every team runs. |
| No | Popular tool | Judgment: SFCB is niche, not a widely used framework or platform. |
| No | Exploited in the wild | Open Source Security: coordinated disclosure of a DoS defect; no observed attacks reported. |
| No | Public exploit | Open Source Security: advisory-style disclosure; no published exploit code or PoC mentioned. |
| Yes | Remote, no login | Open Source Security: remote, pre-authentication denial-of-service in the CIM-XML request parser. |
| No | Full takeover | Open Source Security: impact is DoS with a latent, weak OOB NUL write; no code execution stated. |
| No | Secrets exposed | Open Source Security: describes denial of service only; no data theft or exposure reported. |
| No | Supply chain | Open Source Security: a parser bug in legitimate code; no malicious code shipping reported. |
| No | No fix yet | Open Source Security: no patched version or fix status mentioned in the source; not stated. |
Timeline
Vulnerability disclosed on the oss-security mailing list through coordinated disclosure
Open Source Security
[Coordinated disclosure] sblim-sfcb: pre-auth remote DoS (and latent OOB NUL write) via unbounded quoted-attribute scan in CIM-XML parser (cimXmlParser.c getValue)
Source
[Coordinated disclosure] sblim-sfcb: pre-auth remote DoS (and latent OOB NUL write) via unbounded quoted-attribute scan in CIM-XML parser (cimXmlParser.c getValue) ↗ Open Source Security · 1h ago
First seen · 1 source · Full story page · How tiers are decided