Important: rpcbind

2017-06-06T17:03:00
ID ALAS-2017-841
Type amazon
Reporter Amazon
Modified 2017-06-06T22:50:00

Description

Issue Overview:

It was found that due to the way rpcbind uses libtirpc (libntirpc), a memory
leak can occur when parsing specially crafted XDR messages. An attacker sending
thousands of messages to rpcbind could cause its memory usage to grow without
bound, eventually causing it to be terminated by the OOM killer. (CVE-2017-8779)

Affected Packages:

rpcbind

Issue Correction:
Run yum update rpcbind to update your system.

New Packages:

i686:  
    rpcbind-debuginfo-0.2.0-13.9.amzn1.i686  
    rpcbind-0.2.0-13.9.amzn1.i686

src:  
    rpcbind-0.2.0-13.9.amzn1.src

x86_64:  
    rpcbind-debuginfo-0.2.0-13.9.amzn1.x86_64  
    rpcbind-0.2.0-13.9.amzn1.x86_64