Infinite loop in libtirpc - CVE-2018-14621

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU14698

Infinite loop in libtirpc - CVE-2018-14621

Published: September 6, 2018 / Updated: September 7, 2018


Vulnerability identifier: #VU14698
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-14621
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to improper handling of port settings. A remote attacker can configure the role of the targeted port to poll, rather than select, trigger infinite loop and cause the service to crash.


Affected software

libtirpc
Dynamic System Analysis (DSA) Preboot

How to mitigate CVE-2018-14621

Update to version 1.0.2-rc2.

libtirpc - update to 1.0.2 rc2
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65

External References

Related Security Bulletins