CentOS ProjectCESA-2017:1268libtirpc security update
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.551 Medium
EPSS
Percentile
97.6%
CentOS Errata and Security Advisory CESA-2017:1268
The libtirpc packages contain SunLib’s implementation of transport-independent remote procedure call (TI-RPC) documentation, which includes a library required by programs in the nfs-utils and rpcbind packages.
Security Fix(es):
- It was found that due to the way rpcbind uses libtirpc (libntirpc), a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated by the OOM killer. (CVE-2017-8779)
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2017-May/084578.html
Affected packages:
libtirpc
libtirpc-devel
Upstream details at:
https://access.redhat.com/errata/RHSA-2017:1268
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| CentOS | 6 | i686 | libtirpc | < 0.2.1-13.el6_9 | libtirpc-0.2.1-13.el6_9.i686.rpm |
| CentOS | 6 | i686 | libtirpc-devel | < 0.2.1-13.el6_9 | libtirpc-devel-0.2.1-13.el6_9.i686.rpm |
| CentOS | 6 | i686 | libtirpc | < 0.2.1-13.el6_9 | libtirpc-0.2.1-13.el6_9.i686.rpm |
| CentOS | 6 | x86_64 | libtirpc | < 0.2.1-13.el6_9 | libtirpc-0.2.1-13.el6_9.x86_64.rpm |
| CentOS | 6 | i686 | libtirpc-devel | < 0.2.1-13.el6_9 | libtirpc-devel-0.2.1-13.el6_9.i686.rpm |
| CentOS | 6 | x86_64 | libtirpc-devel | < 0.2.1-13.el6_9 | libtirpc-devel-0.2.1-13.el6_9.x86_64.rpm |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.551 Medium
EPSS
Percentile
97.6%