rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rpcbind | Aug 22, 2024 | May 4, 2017 |
| Amazon_linux | — | Upgrade rpcbindUpgrade libtirpc | Jun 7, 2017 | May 4, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 4, 2017 |
| Centos_linux | — | Upgrade libtirpc-debuginfoUpgrade libtirpcUpgrade libtirpc-develUpgrade rpcbind-debuginfoUpgrade rpcbind | May 24, 2017 | May 4, 2017 |
| Debian | — | Upgrade libtirpcUpgrade ntirpcUpgrade rpcbind | May 9, 2017 | May 4, 2017 |
| Gentoo Linux | — | Upgrade net-nds/rpcbind.Upgrade net-libs/libtirpc. | Oct 30, 2017 | May 4, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade rpcbind | Nov 30, 2017 | May 4, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rpcbind | Nov 30, 2017 | May 4, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rpcbind | Jun 3, 2020 | May 4, 2017 |
| Oracle Solaris | — | Upgrade system/library to version 0.5.11-0.175.3.24.0.3.0 on Solaris 11.3 | Sep 19, 2017 | May 4, 2017 |
| Oracle_linux | — | Upgrade libtirpc-develUpgrade rpcbindUpgrade libtirpc | May 22, 2017 | May 3, 2017 |
| Redhat_linux | — | Upgrade rpcbindUpgrade rpcbind-debuginfoUpgrade libtirpc-develUpgrade libtirpc-debuginfoUpgrade libtirpc | May 23, 2017 | May 4, 2017 |
| Suse | — | Upgrade libtirpc1-32bitUpgrade libtirpc-develUpgrade libtirpc-netconfigUpgrade rpcbindUpgrade libtirpc3-32bitUpgrade libtirpc3Upgrade libtirpc1 | May 16, 2017 | May 4, 2017 |
| Ubuntu | — | Upgrade rpcbindUpgrade libtirpc1Upgrade libtirpc-devUpgrade rpcbind (Ubuntu Pro) | Sep 18, 2018 | May 4, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 4, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub