Amazon Linux 1 (EOL) Security Advisory: ALAS-2017-841
Advisory Released Date: 2017-06-06
Advisory Updated Date: 2017-06-06
Severity:
Important
Issue Overview:
It was found that due to the way rpcbind uses libtirpc (libntirpc), a memory
leak can occur when parsing specially crafted XDR messages. An attacker sending
thousands of messages to rpcbind could cause its memory usage to grow without
bound, eventually causing it to be terminated by the OOM killer. (CVE-2017-8779)
Affected Packages:
rpcbind
Issue Correction:
Run yum update rpcbind to update your system.
New Packages:
i686:
rpcbind-debuginfo-0.2.0-13.9.amzn1.i686
rpcbind-0.2.0-13.9.amzn1.i686
src:
rpcbind-0.2.0-13.9.amzn1.src
x86_64:
rpcbind-debuginfo-0.2.0-13.9.amzn1.x86_64
rpcbind-0.2.0-13.9.amzn1.x86_64