CVE Feed

    Dashboard / CVE / CVE-2017-8779

    CVE-2017-8779

    rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.

    Published:May 3, 2017
    Last Modified:Apr 20, 2025
    EPS:May 4, 2017
    EPSS Score:0.84199
    CVSS Score:7.5

    Affected Products

    Vendor
    Libtirpc Project
    Product
    Libtirpc
    Vendor
    Ntirpc Project
    Product
    Ntirpc
    Vendor
    Redhat
    Product
    Ceph Storage
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Storage
    Vendor
    Rpcbind Project
    Product
    Rpcbind

    Exploits

    https://www.exploit-db.com/exploits/41974https://github.com/drbothen/GO-RPCBOMB

    References

    http://openwall.com/lists/oss-security/2017/05/03/12
    http://openwall.com/lists/oss-security/2017/05/04/1
    http://www.debian.org/security/2017/dsa-3845
    http://www.securityfocus.com/bid/98325
    http://www.securitytracker.com/id/1038532
    https://access.redhat.com/errata/RHBA-2017:1497
    https://access.redhat.com/errata/RHSA-2017:1262
    https://access.redhat.com/errata/RHSA-2017:1263
    https://access.redhat.com/errata/RHSA-2017:1267
    https://access.redhat.com/errata/RHSA-2017:1268
    https://access.redhat.com/errata/RHSA-2017:1395
    https://github.com/drbothen/GO-RPCBOMB
    https://github.com/guidovranken/rpcbomb/
    https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches/
    https://security.gentoo.org/glsa/201706-07
    https://security.netapp.com/advisory/ntap-20180109-0001/
    https://usn.ubuntu.com/3759-1/
    https://usn.ubuntu.com/3759-2/
    https://www.exploit-db.com/exploits/41974/
    http://openwall.com/lists/oss-security/2017/05/03/12
    http://openwall.com/lists/oss-security/2017/05/04/1
    http://www.debian.org/security/2017/dsa-3845
    http://www.securityfocus.com/bid/98325
    http://www.securitytracker.com/id/1038532
    https://access.redhat.com/errata/RHBA-2017:1497
    https://access.redhat.com/errata/RHSA-2017:1262
    https://access.redhat.com/errata/RHSA-2017:1263
    https://access.redhat.com/errata/RHSA-2017:1267
    https://access.redhat.com/errata/RHSA-2017:1268
    https://access.redhat.com/errata/RHSA-2017:1395
    https://github.com/drbothen/GO-RPCBOMB
    https://github.com/guidovranken/rpcbomb/
    https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches/
    https://security.gentoo.org/glsa/201706-07
    https://security.netapp.com/advisory/ntap-20180109-0001/
    https://usn.ubuntu.com/3759-1/
    https://usn.ubuntu.com/3759-2/
    https://www.exploit-db.com/exploits/41974/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High