Denial of service in ntirpc products - CVE-2017-8779

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU6435

Denial of service in ntirpc products - CVE-2017-8779

Published: May 4, 2017 / Updated: September 14, 2018


Vulnerability identifier: #VU6435
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-8779
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in xdr_bytes() and xdr_string() functions when processing RPC data during memory allocation within rpcbind implementation. A remote unauthenticated attacker can send a specially crafted UDP request to port 111 and consume up to 4 gigabytes of memory per request.

Successful exploitation of this vulnerability may result in denial of service (DoS) conditions.


Affected software

RPCBind
libtirpc
ntirpc
Amazon Linux AMI
Arch Linux
CentOS
SUSE Linux
Slackware Linux
Ubuntu
Fedora
Opensuse
rpcbind (Ubuntu package)
rpcbind
libtirpc
linux-firmware (Alpine package)
Dell EMC Unisphere Central

How to mitigate CVE-2017-8779

The vulnerability affects rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3.
To mitigate the issue install the appropriate patch from your OS vendor's website.
As a temporary solution, block all UDP traffic to port 111.


rpcbind (Ubuntu package) - addressed in versions 0.2.3-0.6ubuntu0.18.04.2, 0.2.30.2ubuntu0.16.04.1+esm1
rpcbind - addressed in versions 0.2.4-5.rc1.fc25, 0.2.4-6.rc1.fc26
libtirpc - addressed in versions 1.0.1-4.rc3.fc25, 1.0.1-4.rc3.fc26
Dell EMC Unisphere Central - update to 4.0.7
linux-firmware (Alpine package) - update to 20180615-r2

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins