Security Bulletin: Vulnerability in XDR affects IBM DataPower Gateways (CVE-2017-8804)

Summary A potential Denial of Service vulnerability exists in XDR. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-8804 DESCRIPTION: glibc is vulnerable to a denial of service, caused by improper handling of buffer deserialization in the xdrbytes and...

NIS bootparamd Domain Name Disclosure

This module discloses the NIS domain name from bootparamd. You must know a client address from the target's bootparams file. Hint: try hosts within the same network range as the target. This module requires Metasploit: https://metasploit.com/download Current source:...

Solaris XDR RPC Request Handling RCE (April 2017 CPU) (EBBISLAND / EBBSHAVE)

Binary data rpcebbshave.nbin...

Rpcbind XDR Parsing Memory Exhaustion Denial of Service (CVE-2017-8779)

A resource exhaustion vulnerability exists in rpcbind, within its associated library libtirpc. The vulnerability is due to an unbounded memory leak when parsing XDR strings. A remote attacker could exploit this vulnerability by sending specially crafted RPC messages to the vulnerable server...

libntirpc: Memory leak when failing to parse XDR strings or bytearrays

It was found that due to the way rpcbind uses libtirpc libntirpc, a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated by the OOM killer...

Important: Red Hat Security Advisory: libntirpc security update

An update for libntirpc is now available for Red Hat Gluster Storage 3.2 for RHEL 6 and Red Hat Gluster Storage 3.2 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Important: libtirpc

Issue Overview: Memory leak when failing to parse XDR strings or bytearrays It was found that due to the way rpcbind uses libtirpc libntirpc, a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to...

Important: rpcbind

Issue Overview: It was found that due to the way rpcbind uses libtirpc libntirpc, a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated by...

RHEL 6 : rpcbind (RHSA-2017:1267)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2017:1267 advisory. The rpcbind utility is a server that converts Remote Procedure Call RPC program numbers into universal addresses. It must be running on the host to b...

CentOS Update for rpcbind CESA-2017:1267 centos6

Check the version of rpcbind SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882722";...

rpcbind security update

CentOS Errata and Security Advisory CESA-2017:1267 An update for rpcbind is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

libntirpc: Memory leak when failing to parse XDR strings or bytearrays

It was found that due to the way rpcbind uses libtirpc libntirpc, a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated by the OOM killer...

libntirpc: Memory leak when failing to parse XDR strings or bytearrays

It was found that due to the way rpcbind uses libtirpc libntirpc, a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated by the OOM killer...

libntirpc: Memory leak when failing to parse XDR strings or bytearrays

It was found that due to the way rpcbind uses libtirpc libntirpc, a memory leak can occur when parsing specially crafted XDR messages. An attacker sending thousands of messages to rpcbind could cause its memory usage to grow without bound, eventually causing it to be terminated by the OOM killer...

GNU C Library 'xdr_bytes' and 'xdr_string' Function Denial of Service Vulnerability

The GNU C Library a.k.a. glibc, libc6 is an open-source, free C language compiler released under the LGPL license. A denial of service vulnerability exists in the 'xdrbytes' and 'xdrstring' functions in GNU C Library version 2.25, which stems from the program failing to properly handle buffer...

PT-2017-2115 · Gnu +2 · Glibc +2

Name of the Vulnerable Software and Affected Versions: glibc versions 2.25 Description: The issue is related to the xdr bytes and xdr string functions in the GNU C Library, which mishandle failures of buffer deserialization. This can be exploited by a remote attacker using a specially crafted UDP...

CVE-2017-8779

rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service memory consumption with no subsequent free via a...

CVE-2017-8779

rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service memory consumption with no subsequent free via a...

HPE LoadRunner and Performance Center libxdrutil.dll mxdr_string Heap Buffer Overflow (CVE-2017-5789)

A heap buffer overflow vulnerability exists in HP LoadRunner and Performance Center. The vulnerability is due to insufficient validation of the length of XDR encoded string. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to the vulnerable...

Aerospike Database Detection (XDR)

Cross-Datacenter Replication XDR based detection of the Aerospike Database. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...