[ GLSA 201611-17 ] RPCBind

[GLSA]

Gentoo Linux Security Advisory

Title: RPCBind: Denial of Service (GLSA 201611-17)
Severity: normal
Exploitable: remote
Date: November 22, 2016
Bug(s): #560990
ID: 201611-17

Synopsis

A buffer overflow in RPCBind might allow remote attackers to cause
a Denial of Service.


Background

The RPCBind utility is a server that converts RPC program numbers into
universal addresses.


Affected Packages

Package: net-nds/rpcbind
Vulnerable: < 0.2.3-r1
Unaffected: >= 0.2.3-r1
Architectures: All supported architectures


Description

A use-after-free vulnerability was discovered in RPCBind’s
svc_dodestroy function when trying to free a corrupted xprt->xp_netid
pointer.


Impact

A remote attacker could possibly cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All RPCBind users should upgrade to the latest version: