rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade rpcbind | Aug 22, 2024 | May 4, 2017 |
| Amazon_linux | — | Upgrade libtirpcUpgrade rpcbind | Jun 7, 2017 | May 4, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | May 4, 2017 |
| Centos_linux | — | Upgrade libtirpcUpgrade libtirpc-debuginfoUpgrade rpcbindUpgrade libtirpc-develUpgrade rpcbind-debuginfo | May 24, 2017 | May 4, 2017 |
| Debian | — | Upgrade rpcbindUpgrade ntirpcUpgrade libtirpc | May 9, 2017 | May 4, 2017 |
| Gentoo Linux | — | Upgrade net-libs/libtirpc.Upgrade net-nds/rpcbind. | Oct 30, 2017 | May 4, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade rpcbind | Nov 30, 2017 | May 4, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rpcbind | Nov 30, 2017 | May 4, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade rpcbind | Jun 3, 2020 | May 4, 2017 |
| Oracle Solaris | — | Upgrade system/library to version 0.5.11-0.175.3.24.0.3.0 on Solaris 11.3 | Sep 19, 2017 | May 4, 2017 |
| Oracle_linux | — | Upgrade libtirpc-develUpgrade rpcbindUpgrade libtirpc | May 22, 2017 | May 3, 2017 |
| Redhat_linux | — | Upgrade libtirpc-develUpgrade rpcbind-debuginfoUpgrade rpcbindUpgrade libtirpcUpgrade libtirpc-debuginfo | May 23, 2017 | May 4, 2017 |
| Suse | — | Upgrade libtirpc1Upgrade libtirpc3Upgrade libtirpc3-32bitUpgrade libtirpc1-32bitUpgrade libtirpc-develUpgrade rpcbindUpgrade libtirpc-netconfig | May 16, 2017 | May 4, 2017 |
| Ubuntu | — | Upgrade rpcbind (Ubuntu Pro)Upgrade libtirpc-devUpgrade libtirpc1Upgrade rpcbind | Sep 18, 2018 | May 4, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 4, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub