CVE-2017-8779
Fixed in a distro release EPSS 81%
rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.
Products: rpcbind_project rpcbind, libtirpc_project libtirpc, ntirpc_project ntirpc
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | rpcbind | 0.2.4-r0 |
| Alpine 3.11 | rpcbind | 0.2.4-r0 |
| Alpine 3.12 | rpcbind | 0.2.4-r0 |
| Alpine 3.13 | rpcbind | 0.2.4-r0 |
| Alpine 3.14 | rpcbind | 0.2.4-r0 |
| Alpine 3.15 | rpcbind | 0.2.4-r0 |
| Alpine 3.16 | rpcbind | 0.2.4-r0 |
| Alpine 3.17 | rpcbind | 0.2.4-r0 |
| Alpine 3.18 | rpcbind | 0.2.4-r0 |
| Alpine 3.19 | rpcbind | 0.2.4-r0 |
| Alpine 3.20 | rpcbind | 0.2.4-r0 |
| Alpine 3.21 | rpcbind | 0.2.4-r0 |
| Alpine 3.22 | rpcbind | 0.2.4-r0 |
| Alpine 3.23 | rpcbind | 0.2.4-r0 |
| Alpine 3.24 | rpcbind | 0.2.4-r0 |
| Alpine 3.7 | rpcbind | 0.2.4-r0 |
| Alpine 3.8 | rpcbind | 0.2.4-r0 |
| Alpine 3.9 | rpcbind | 0.2.4-r0 |
| Arch Linux | libtirpc | 1.0.1-3 |
| Arch Linux | rpcbind | 0.2.4-3 |
| Debian 12 | libtirpc | 0.2.5-1.2 |
| Debian 12 | ntirpc | 1.4.4-1 |
| Debian 12 | rpcbind | 0.2.3-0.6 |
| Debian 13 | libtirpc | 0.2.5-1.2 |
| Debian 13 | ntirpc | 1.4.4-1 |
| Debian 13 | rpcbind | 0.2.3-0.6 |
| Debian 14 | libtirpc | 0.2.5-1.2 |
| Debian 14 | ntirpc | 1.4.4-1 |
| Debian 14 | rpcbind | 0.2.3-0.6 |
| Debian 7 | libtirpc | 0.2.2-5+deb7u1 |
| Debian 7 | rpcbind | 0.2.0-8+deb7u2 |
| Debian 8 | libtirpc | 0.2.5-1+deb8u1 |
| Debian 8 | rpcbind | 0.2.1-6+deb8u2 |
| Red Hat ceph storage 2 | calamari-server | 0:1.5.6-2.el7cp |
| Red Hat ceph storage 2 | ceph | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | ceph-base | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | ceph-common | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | ceph-fuse | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | ceph-iscsi-cli | 0:2.0-5.el7cp |
| Red Hat ceph storage 2 | ceph-iscsi-config | 0:2.0-4.el7cp |
| Red Hat ceph storage 2 | ceph-iscsi-tools | 0:2.0-3.el7cp |
| Red Hat ceph storage 2 | ceph-mds | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | ceph-mon | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | ceph-osd | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | ceph-radosgw | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | ceph-selinux | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | ceph-test | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | libcephfs1 | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | libcephfs1-devel | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | libntirpc | 0:1.4.3-2.el7 |
| Red Hat ceph storage 2 | libntirpc-debuginfo | 0:1.4.3-2.el7 |
| Red Hat ceph storage 2 | librados2 | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | librados2-devel | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | librbd1 | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | librbd1-devel | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | librgw2 | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | librgw2-devel | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | libtcmu | 0:1.2.1-0.2.20170104.git3d33566.el7cp |
| Red Hat ceph storage 2 | nfs-ganesha | 0:2.4.5-7.el7cp |
| Red Hat ceph storage 2 | nfs-ganesha-debuginfo | 0:2.4.5-7.el7cp |
| Red Hat ceph storage 2 | nfs-ganesha-rgw | 0:2.4.5-7.el7cp |
| Red Hat ceph storage 2 | pcp-pmda-lio | 0:1.0-2.el7cp |
| Red Hat ceph storage 2 | python-cephfs | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | python-crypto | 0:2.6.1-1.2.el7cp |
| Red Hat ceph storage 2 | python-crypto-debuginfo | 0:2.6.1-1.2.el7cp |
| Red Hat ceph storage 2 | python-flask | 1:0.10.1-5.el7 |
| Red Hat ceph storage 2 | python-itsdangerous | 0:0.23-1.el7 |
| Red Hat ceph storage 2 | python-jinja2 | 0:2.7.2-2.el7cp |
| Red Hat ceph storage 2 | python-rados | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | python-rbd | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | python-rtslib | 0:2.1.fb64-0.1.20170301.git3637171.el7cp |
| Red Hat ceph storage 2 | python-werkzeug | 0:0.9.1-1.el7 |
| Red Hat ceph storage 2 | rbd-mirror | 1:10.2.7-27.el7cp |
| Red Hat ceph storage 2 | targetcli | 0:2.1.fb47-0.1.20170301.gitf632f38.el7cp |
| Red Hat ceph storage 2 | tcmu-runner | 0:1.2.1-0.2.20170104.git3d33566.el7cp |
| Red Hat ceph storage 2 | tcmu-runner-debuginfo | 0:1.2.1-0.2.20170104.git3d33566.el7cp |
| Red Hat ceph storage 2 | userspace-rcu | 0:0.7.16-1.el7cp |
| Red Hat ceph storage 2 | userspace-rcu-debuginfo | 0:0.7.16-1.el7cp |
| Red Hat Enterprise Linux 6 | libtirpc | 0:0.2.1-13.el6_9 |
| Red Hat Enterprise Linux 6 | libtirpc-debuginfo | 0:0.2.1-13.el6_9 |
| Red Hat Enterprise Linux 6 | libtirpc-devel | 0:0.2.1-13.el6_9 |
| Red Hat Enterprise Linux 6 | rpcbind | 0:0.2.0-13.el6_9 |
| Red Hat Enterprise Linux 6 | rpcbind-debuginfo | 0:0.2.0-13.el6_9 |
| Red Hat Enterprise Linux 7 | libtirpc | 0:0.2.4-0.8.el7_3 |
| Red Hat Enterprise Linux 7 | libtirpc-debuginfo | 0:0.2.4-0.8.el7_3 |
| Red Hat Enterprise Linux 7 | libtirpc-devel | 0:0.2.4-0.8.el7_3 |
| Red Hat Enterprise Linux 7 | rpcbind | 0:0.2.0-38.el7_3 |
| Red Hat Enterprise Linux 7 | rpcbind-debuginfo | 0:0.2.0-38.el7_3 |
| Red Hat storage 3.2 nfs el6 | libntirpc | 0:1.4.3-4.el6rhs |
| Red Hat storage 3.2 nfs el6 | libntirpc-debuginfo | 0:1.4.3-4.el6rhs |
| Red Hat storage 3.2 nfs el6 | libntirpc-devel | 0:1.4.3-4.el6rhs |
| Red Hat storage 3.2 nfs el7 | libntirpc | 0:1.4.3-4.el7rhgs |
| Red Hat storage 3.2 nfs el7 | libntirpc-debuginfo | 0:1.4.3-4.el7rhgs |
| Red Hat storage 3.2 nfs el7 | libntirpc-devel | 0:1.4.3-4.el7rhgs |
| SUSE Linux Enterprise Desktop 12 SP1 | libtirpc | 0.2.3-13.3.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | rpcbind | 0.2.1_rc4-17.3.1 |
| SUSE Linux Enterprise Desktop 12 SP2 | libtirpc | 1.0.1-16.1 |
| SUSE Linux Enterprise Desktop 12 SP2 | rpcbind | 0.2.3-23.1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | libtirpc | 0.2.1-1.12.3 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | rpcbind | 0.1.6+git20080930-6.27.2 |
| SUSE Linux Enterprise Server 11 SP3-LTSS | libtirpc | 0.2.1-1.12.3 |
| SUSE Linux Enterprise Server 11 SP3-LTSS | rpcbind | 0.1.6+git20080930-6.27.2 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | libtirpc | 0.2.1-1.12.3 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | rpcbind | 0.1.6+git20080930-6.27.2 |
| SUSE Linux Enterprise Server 11 SP4 | libtirpc | 0.2.1-1.12.3 |
| SUSE Linux Enterprise Server 11 SP4 | rpcbind | 0.1.6+git20080930-6.27.2 |
| SUSE Linux Enterprise Server 12 SP1 | libtirpc | 0.2.3-13.3.1 |
| SUSE Linux Enterprise Server 12 SP1 | rpcbind | 0.2.1_rc4-17.3.1 |
| SUSE Linux Enterprise Server 12 SP2 | libtirpc | 1.0.1-16.1 |
| SUSE Linux Enterprise Server 12 SP2 | rpcbind | 0.2.3-23.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | libtirpc | 1.0.1-16.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | rpcbind | 0.2.3-23.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | libtirpc | 0.2.1-1.12.3 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | rpcbind | 0.1.6+git20080930-6.27.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | libtirpc | 0.2.3-13.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | rpcbind | 0.2.1_rc4-17.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | libtirpc | 1.0.1-16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | rpcbind | 0.2.3-23.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | libtirpc | 0.2.1-1.12.3 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | libtirpc | 0.2.3-13.3.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | libtirpc | 1.0.1-16.1 |
| Ubuntu 14.04 LTS | libtirpc | 0.2.2-5ubuntu2.1 |
| Ubuntu 16.04 LTS | libtirpc | 0.2.5-1ubuntu0.1 |
| Ubuntu 16.04 LTS | ntirpc | no fix |
| Ubuntu 18.04 LTS | libtirpc | 0.2.5-1.2ubuntu0.1 |
| Ubuntu 18.04 LTS | rpcbind | 0.2.3-0.6ubuntu0.18.04.2 |
| Ubuntu Pro 14.04 LTS | rpcbind | 0.2.1-2ubuntu2.2+esm1 |
| Ubuntu Pro 16.04 LTS | rpcbind | 0.2.3-0.2ubuntu0.16.04.1+esm1 |
| openSUSE Tumbleweed | rpcbind | 1.2.6-2.2 |