Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2017-8779

UNKNOWN
Published 2017-05-04T14:00:00
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2017-8779. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed HIGH

GHSA-fr7x-wc8q-h255

Advisory Details

rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2017-8779
WEB https://access.redhat.com/errata/RHBA-2017:1497
WEB https://access.redhat.com/errata/RHSA-2017:1262
WEB https://access.redhat.com/errata/RHSA-2017:1263
WEB https://access.redhat.com/errata/RHSA-2017:1267
WEB https://access.redhat.com/errata/RHSA-2017:1268
WEB https://access.redhat.com/errata/RHSA-2017:1395
WEB https://github.com/drbothen/GO-RPCBOMB
WEB https://github.com/guidovranken/rpcbomb
WEB https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches
WEB https://security.gentoo.org/glsa/201706-07
WEB https://security.netapp.com/advisory/ntap-20180109-0001
WEB https://usn.ubuntu.com/3759-1
WEB https://usn.ubuntu.com/3759-2
WEB https://www.exploit-db.com/exploits/41974
WEB http://openwall.com/lists/oss-security/2017/05/03/12
WEB http://openwall.com/lists/oss-security/2017/05/04/1
WEB http://www.debian.org/security/2017/dsa-3845
WEB http://www.securityfocus.com/bid/98325
WEB http://www.securitytracker.com/id/1038532

Advisory provided by GitHub Security Advisory Database. Published: May 13, 2022, Modified: April 20, 2025

References

https://usn.ubuntu.com/3759-2/
https://access.redhat.com/errata/RHSA-2017:1267
https://usn.ubuntu.com/3759-1/
https://access.redhat.com/errata/RHSA-2017:1262
https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches/
https://access.redhat.com/errata/RHSA-2017:1268
https://github.com/drbothen/GO-RPCBOMB
https://access.redhat.com/errata/RHBA-2017:1497
https://github.com/guidovranken/rpcbomb/
https://security.netapp.com/advisory/ntap-20180109-0001/
https://security.gentoo.org/glsa/201706-07
http://www.securitytracker.com/id/1038532
http://www.securityfocus.com/bid/98325
http://openwall.com/lists/oss-security/2017/05/03/12
http://openwall.com/lists/oss-security/2017/05/04/1
https://access.redhat.com/errata/RHSA-2017:1395
https://access.redhat.com/errata/RHSA-2017:1263
https://www.exploit-db.com/exploits/41974/
http://www.debian.org/security/2017/dsa-3845

HackerOne Reports

rpcbind "rpcbomb" CVE-2017-8779, CVE-2017-8804 High
guido
Internet Bug Bounty
Uncontrolled Resource Consumption
View Report
Published: 2017-05-04T14:00:00
Last Modified: 2024-08-05T16:48:22.685Z
Copied to clipboard!