drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Denial of Service in Libtirpc und RPCBind
Name: |
Denial of Service in Libtirpc und RPCBind |
|
ID: |
201706-07 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Di, 6. Juni 2017, 14:44 |
|
Referenzen: |
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8779 |
|
Applikationen: |
rpcbind, libtirpc |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --MAWonucbfvhkJ53UcHpHg5TJEesf0C53S Content-Type: multipart/mixed; boundary="4AQFS0KtWMP8jwnEclX1WrDEvULCeCuRI"; protected-headers="v1" From: Thomas Deutschmann <whissi@gentoo.org> Reply-To: security@gentoo.org To: gentoo-announce@lists.gentoo.org Message-ID: <45da9a08-9e61-969e-a796-472a6e4d6d21@gentoo.org> Subject: [ GLSA 201706-07 ] Libtirpc and RPCBind: Denial of Service
--4AQFS0KtWMP8jwnEclX1WrDEvULCeCuRI Content-Type: text/plain; charset=utf-8 Content-Language: en-U Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201706-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: Libtirpc and RPCBind: Denial of Service Date: June 06, 2017 Bugs: #617472 ID: 201706-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
A vulnerability has been found in Libtirpc and RPCBind which may allow a remote attacker to cause a Denial of Service condition.
Background ==========
The RPCBind utility is a server that converts RPC program numbers into universal addresses.
Libtirpc is a port of Suns Transport-Independent RPC library to Linux.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-nds/rpcbind < 0.2.4-r >= 0.2.4-r 2 net-libs/libtirpc < 1.0.1-r1 >= 1.0.1-r1 ------------------------------------------------------------------- 2 affected packages
Description ===========
It was found that due to the way RPCBind uses libtirpc (libntirpc), a memory leak can occur when parsing specially crafted XDR messages.
Impact ======
A remote attacker could send thousands of messages to RPCBind, possibly resulting in a Denial of Service condition.
Workaround ==========
There is no known workaround at this time.
Resolution ==========
All RPCBind users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-nds/rpcbind-0.2.4-r"
All Libtirpc users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/libtirpc-1.0.1-r1"
References ==========
[ 1 ] CVE-2017-8779 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8779
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/201706-07
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License =======
Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--4AQFS0KtWMP8jwnEclX1WrDEvULCeCuRI--
--MAWonucbfvhkJ53UcHpHg5TJEesf0C53S Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0
iQJ8BAEBCgBmBQJZNmuqXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQzM0M1ODQ4MkM0MDIyOTJEMkUzQzVDMDY5 NzA5RjkwQzNDOTZGRkM4AAoJEJcJ+Qw8lv/Iu9AQAKUDVeCgkxcrzvyDYFlHxRh0 B8f3sKQ7NFtFtK/jS9afM1XMohPLOE2PpkypGQAwB9adYIfyrlNXJJEQCccW7EDo c8JM34UQOSJe/SIqE2xrqQqReCLUiL+pflojq+qAQk01bIqdjAg50BPPzGY+/cm1 UtHLj83dwSBQTk5vbfNeNQ6/ldG8w2OuvQdcJV+qp7Zz/CRlumGtlllUT+POl6xx 7pJXwwJg6ZlPLbgTpRFqO+BC/Qc4JrW4KAivc8YV42RKNYjCcYx4G+KA80XFULl1 skCzf9HVENi1qEwqZCeAPdsyBE7AWebVda0KCkO0YUySW0nqUPInH4VgU64n4vyP qnomCibMBFuVLXeOlWxTHo11FKfp0kZ2W2ArH8W5JJfcD4M85+3C+dpGWm5V2u80 Mo40L1keQMlO+ruESVt64qhgTdVhqyJwfUd+pBRcGNzMP6VfAR4c4nyPiLlXcZiA GazB0B+GyngsTITPGbFB3IBNNMmCsSEiyKb2mZ7MI8a2u4hW9xFKLnIwa8lhstPm BzF3L5H2sKRPoAnPSMP/4zP16vbHpkQQCp7GbVQOMF8Tn5gkOv/Zo0dNj0Rh/yB1 6UBbhVVCOlVQR2ZoeXkuo54ppC/9xuSf7YN2NW7ltT8ovv5gASCwU8nY1hjKNzgE KHSD4Vzv4Q4xiybRcqDb =PFud -----END PGP SIGNATURE-----
--MAWonucbfvhkJ53UcHpHg5TJEesf0C53S--
|
|
|
|