CVE-2017-8779
- State
- Published
- Severity
- Not scored
- Published
- May 4, 2017
- Updated
- Aug 5, 2024
- Reserved
- May 4, 2017
Description
rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- USN-3759-2vendor-advisory
- RHSA-2017:1267vendor-advisory
- USN-3759-1vendor-advisory
- RHSA-2017:1262vendor-advisory
- https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches/
- RHSA-2017:1268vendor-advisory
- https://github.com/drbothen/GO-RPCBOMB
- RHBA-2017:1497vendor-advisory
- https://github.com/guidovranken/rpcbomb/
- https://security.netapp.com/advisory/ntap-20180109-0001/
- GLSA-201706-07vendor-advisory
- 1038532vdb-entry
- 98325vdb-entry
- http://openwall.com/lists/oss-security/2017/05/03/12
- http://openwall.com/lists/oss-security/2017/05/04/1
- RHSA-2017:1395vendor-advisory
- RHSA-2017:1263vendor-advisory
- 41974exploit
- DSA-3845vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.