Rpcbind Memory Leak in rpcb_service_4() Lets Remote Users Consume Excessive Memory Resources
|
|
SecurityTracker Alert ID: 1038532 |
|
SecurityTracker URL: http://securitytracker.com/id/1038532
|
|
CVE Reference:
CVE-2017-8779
(Links to External Site)
|
Updated: May 22 2017
|
Original Entry Date: May 22 2017
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
|
Description:
A vulnerability was reported in Rpcbind. A remote user can consume excessive memory on the target system.
A remote user can send a large number of specially crafted XDR messages to trigger a memory leak in rpcb_service_4() to consume excessive memory on the target system.
The vulnerability resides in the libntirpc component.
The original advisory and demonstration exploit is available at:
https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches/
Guido Vranken reported this vulnerability.
|
Impact:
A remote user can consume excessive memory resources on the target system.
|
Solution:
The vendor has issued a source code fix, available at:
http://git.linux-nfs.org/?p=steved/rpcbind.git;a=blob;f=src/pmap_svc.c;h=26c31d0f824f0eeff2f269310ca6dac34d5df1f9;hb=c49a7ea639eb700823e174fd605bbbe183e229aa
|
Vendor URL: sourceforge.net/projects/libtirpc/ (Links to External Site)
|
Cause:
Resource error
|
Underlying OS: Linux (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
