RHSA-2017:1267
Vulnerability from csaf_redhat
Published
2017-05-23 07:38
Modified
2024-11-14 23:34
Summary
Red Hat Security Advisory: rpcbind security update

Notes

Topic
An update for rpcbind is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 16 June 2017] The packages distributed with this errata have a bug that can cause the rpcbind utility to terminate unexpectedly at start. RHBA-2017:1435 was released on 13 June 2017 to address this issue.
Details
The rpcbind utility is a server that converts Remote Procedure Call (RPC) program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine. Security Fix(es): * It was found that due to the way rpcbind uses libtirpc (libntirpc), a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated by the OOM killer. (CVE-2017-8779)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rpcbind is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\n[Updated 16 June 2017]\nThe packages distributed with this errata have a bug that can cause the rpcbind utility to terminate unexpectedly at start. RHBA-2017:1435 was released on 13 June 2017 to address this issue.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The rpcbind utility is a server that converts Remote Procedure Call (RPC) program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine.\n\nSecurity Fix(es):\n\n* It was found that due to the way rpcbind uses libtirpc (libntirpc), a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated by the OOM killer. (CVE-2017-8779)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2017:1267",
        "url": "https://access.redhat.com/errata/RHSA-2017:1267"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/errata/RHBA-2017:1435",
        "url": "https://access.redhat.com/errata/RHBA-2017:1435"
      },
      {
        "category": "external",
        "summary": "1448124",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1448124"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1267.json"
      }
    ],
    "title": "Red Hat Security Advisory: rpcbind security update",
    "tracking": {
      "current_release_date": "2024-11-14T23:34:26+00:00",
      "generator": {
        "date": "2024-11-14T23:34:26+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2017:1267",
      "initial_release_date": "2017-05-23T07:38:20+00:00",
      "revision_history": [
        {
          "date": "2017-05-23T07:38:20+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2017-06-16T15:06:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T23:34:26+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop (v. 6)",
                  "product_id": "6Client-6.9.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux HPC Node (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux HPC Node (v. 6)",
                  "product_id": "6ComputeNode-6.9.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::computenode"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server-6.9.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::server"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation-6.9.z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rpcbind-0:0.2.0-13.el6_9.x86_64",
                "product": {
                  "name": "rpcbind-0:0.2.0-13.el6_9.x86_64",
                  "product_id": "rpcbind-0:0.2.0-13.el6_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rpcbind@0.2.0-13.el6_9?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
                "product": {
                  "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
                  "product_id": "rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rpcbind-debuginfo@0.2.0-13.el6_9?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rpcbind-0:0.2.0-13.el6_9.src",
                "product": {
                  "name": "rpcbind-0:0.2.0-13.el6_9.src",
                  "product_id": "rpcbind-0:0.2.0-13.el6_9.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rpcbind@0.2.0-13.el6_9?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rpcbind-0:0.2.0-13.el6_9.i686",
                "product": {
                  "name": "rpcbind-0:0.2.0-13.el6_9.i686",
                  "product_id": "rpcbind-0:0.2.0-13.el6_9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rpcbind@0.2.0-13.el6_9?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
                "product": {
                  "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
                  "product_id": "rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rpcbind-debuginfo@0.2.0-13.el6_9?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rpcbind-0:0.2.0-13.el6_9.s390x",
                "product": {
                  "name": "rpcbind-0:0.2.0-13.el6_9.s390x",
                  "product_id": "rpcbind-0:0.2.0-13.el6_9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rpcbind@0.2.0-13.el6_9?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
                "product": {
                  "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
                  "product_id": "rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rpcbind-debuginfo@0.2.0-13.el6_9?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rpcbind-0:0.2.0-13.el6_9.ppc64",
                "product": {
                  "name": "rpcbind-0:0.2.0-13.el6_9.ppc64",
                  "product_id": "rpcbind-0:0.2.0-13.el6_9.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rpcbind@0.2.0-13.el6_9?arch=ppc64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
                "product": {
                  "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
                  "product_id": "rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rpcbind-debuginfo@0.2.0-13.el6_9?arch=ppc64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.i686",
        "relates_to_product_reference": "6Client-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.ppc64",
        "relates_to_product_reference": "6Client-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.s390x",
        "relates_to_product_reference": "6Client-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.src as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.src"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.src",
        "relates_to_product_reference": "6Client-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.x86_64",
        "relates_to_product_reference": "6Client-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
        "relates_to_product_reference": "6Client-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
        "relates_to_product_reference": "6Client-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
        "relates_to_product_reference": "6Client-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
          "product_id": "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
        "relates_to_product_reference": "6Client-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.i686",
        "relates_to_product_reference": "6ComputeNode-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.ppc64",
        "relates_to_product_reference": "6ComputeNode-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.s390x as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.s390x",
        "relates_to_product_reference": "6ComputeNode-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.src"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.src",
        "relates_to_product_reference": "6ComputeNode-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.x86_64",
        "relates_to_product_reference": "6ComputeNode-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.i686 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
        "relates_to_product_reference": "6ComputeNode-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
        "relates_to_product_reference": "6ComputeNode-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
        "relates_to_product_reference": "6ComputeNode-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)",
          "product_id": "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
        "relates_to_product_reference": "6ComputeNode-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.i686",
        "relates_to_product_reference": "6Server-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.ppc64",
        "relates_to_product_reference": "6Server-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.s390x as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.s390x",
        "relates_to_product_reference": "6Server-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.src as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.src"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.src",
        "relates_to_product_reference": "6Server-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.x86_64",
        "relates_to_product_reference": "6Server-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
        "relates_to_product_reference": "6Server-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
        "relates_to_product_reference": "6Server-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
        "relates_to_product_reference": "6Server-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
        "relates_to_product_reference": "6Server-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.i686",
        "relates_to_product_reference": "6Workstation-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.ppc64",
        "relates_to_product_reference": "6Workstation-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.s390x",
        "relates_to_product_reference": "6Workstation-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.src"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.src",
        "relates_to_product_reference": "6Workstation-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-0:0.2.0-13.el6_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64"
        },
        "product_reference": "rpcbind-0:0.2.0-13.el6_9.x86_64",
        "relates_to_product_reference": "6Workstation-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
        "relates_to_product_reference": "6Workstation-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
        "relates_to_product_reference": "6Workstation-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
        "relates_to_product_reference": "6Workstation-6.9.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64"
        },
        "product_reference": "rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
        "relates_to_product_reference": "6Workstation-6.9.z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-8779",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2017-05-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1448124"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that due to the way rpcbind uses libtirpc (libntirpc), a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated by the OOM killer.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libntirpc: Memory leak when failing to parse XDR strings or bytearrays",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In the default system configuration, with the sysctl variable vm.overcommit_memory set to either 0 (the default) or 1, an attack would take a not-insignificant amount of time to exhaust the system\u0027s memory. If vm.overcommit_memory is set to a value of 2, the time required to exhaust system memory is sufficiently reduced. It was further noticed that, a 32-bit system would have its memory exhausted faster than a 64-bit system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
          "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
          "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
          "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
          "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
          "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
          "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
          "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
          "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
          "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
          "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
          "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
          "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
          "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
          "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
          "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
          "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
          "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
          "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
          "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
          "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
          "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
          "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
          "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
          "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
          "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
          "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
          "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
          "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
          "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
          "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
          "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
          "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
          "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
          "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
          "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-8779"
        },
        {
          "category": "external",
          "summary": "RHBZ#1448124",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1448124"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-8779",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-8779"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-8779",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8779"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/solutions/3025811/",
          "url": "https://access.redhat.com/solutions/3025811/"
        }
      ],
      "release_date": "2017-05-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-05-23T07:38:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1267"
        },
        {
          "category": "workaround",
          "details": "rpcbind should be protected by iptables so that only trusted hosts that require access can reach it (eg, nfs clients).  Applying per-IP rate limits in iptables will also significantly limit the impact of this attack.  The default iptables rules in the system-config-firewall or firewalld package deny all remote access to rpcbind.\n\nIf you elect to run your system with overcommit turned off, daemons should have memory limits enforced by the init system to ensure stability.  With systemd, use directives such as LimitAS in unit files.  With upstart, place ulimit commands in /etc/sysconfig/$daemon.",
          "product_ids": [
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6Client-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6Client-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6ComputeNode-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6ComputeNode-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6Server-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6Server-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.i686",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.ppc64",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.s390x",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.src",
            "6Workstation-6.9.z:rpcbind-0:0.2.0-13.el6_9.x86_64",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.i686",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.ppc64",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.s390x",
            "6Workstation-6.9.z:rpcbind-debuginfo-0:0.2.0-13.el6_9.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libntirpc: Memory leak when failing to parse XDR strings or bytearrays"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.