Arch Linux Security Advisory ASA-201705-4 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : rpcbind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-261 Summary ======= The package rpcbind before version 0.2.4-3 is vulnerable to denial of service. Resolution ========== Upgrade to 0.2.4-3. # pacman -Syu "rpcbind>=0.2.4-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that libtirpc and libntirpc fails to free a buffer allocated for parsing XDR blocks when parsing fails due to insufficient input data being available. A specially crafted message sent to a service such as rpcbind results in a memory leak, causing the application to crash or other processes to be impacted via the OOM killer. Impact ====== A remote attacker is able to send specially crafted input to leak memory, possibly leading to denial of service. References ========== https://bugs.archlinux.org/task/53927 https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-... https://security.archlinux.org/CVE-2017-8779