CVE-2017-8779 rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows....
HighCVSS 7.5
EPSS 81.2%
Framework module
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libtirpc(Debian:12) | < 0.2.5-1.2 | 0.2.5-1.2 |
| debian/libtirpc(Debian:13) | < 0.2.5-1.2 | 0.2.5-1.2 |
| debian/libtirpc(Debian:14) | < 0.2.5-1.2 | 0.2.5-1.2 |
| debian/ntirpc(Debian:12) | < 1.4.4-1 | 1.4.4-1 |
| debian/ntirpc(Debian:13) | < 1.4.4-1 | 1.4.4-1 |
| debian/ntirpc(Debian:14) | < 1.4.4-1 | 1.4.4-1 |
| debian/rpcbind(Debian:12) | < 0.2.3-0.6 | 0.2.3-0.6 |
| debian/rpcbind(Debian:13) | < 0.2.3-0.6 | 0.2.3-0.6 |
| debian/rpcbind(Debian:14) | < 0.2.3-0.6 | 0.2.3-0.6 |
| rpcbind project rpcbind | <= 0.2.4 | No fix listed |
| libtirpc project libtirpc | <= 1.0.1 | No fix listed |
| ntirpc project ntirpc | <= 1.4.3 | No fix listed |
| alpine/rpcbind(Alpine:v3.10) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.11) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.12) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.13) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.14) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.15) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.16) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.17) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.18) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.19) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.20) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.21) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.22) | < 0.2.4-r0 | 0.2.4-r0 |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/rpcbind(Alpine:v3.23) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.24) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.7) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.8) | < 0.2.4-r0 | 0.2.4-r0 |
| alpine/rpcbind(Alpine:v3.9) | < 0.2.4-r0 | 0.2.4-r0 |
References
- Debian Security Tracker CVE-2017-8779 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking
- openwall.com mailing-list patch third-party-advisory
- openwall.com mailing-list patch third-party-advisory
- DSA-3845 vendor-advisory
- 98325 third-party-advisory vdb-entry
- 1038532 vdb-entry
- RHBA-2017:1497 vendor-advisory
- RHSA-2017:1262 vendor-advisory
- RHSA-2017:1263 vendor-advisory
- RHSA-2017:1267 vendor-advisory
- RHSA-2017:1268 vendor-advisory
- RHSA-2017:1395 vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- guidovranken.wordpress.com third-party-advisory
- GLSA-201706-07 vendor-advisory
- security.netapp.com
- USN-3759-1 vendor-advisory
- USN-3759-2 vendor-advisory
- 41974 exploit
- security.alpinelinux.org vendor-advisory