CVE-2017-8779
HIGHrpcbind < 0.2.4 - Denial of Service via Crafted UDP Packet
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2017-8779.
PoCs published by Guido Vranken, drbothen, guidovranken, including Metasploit module auxiliary/dos/rpc/rpcbomb.
AI-analyzed exploit summary This exploit targets a denial-of-service (DoS) vulnerability in *nix rpcbind/libtirpc by sending a maliciously crafted UDP packet to allocate a large number of bytes, causing the service to crash. The PoC constructs a UDP packet with specific RPC fields and sends it to the target host.
Description
rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.
Exploits (3)
This exploit targets a denial-of-service (DoS) vulnerability in *nix rpcbind/libtirpc by sending a maliciously crafted UDP packet to allocate a large number of bytes, causing the service to crash. The PoC constructs a UDP packet with specific RPC fields and sends it to the target host.
This is a Go-based proof-of-concept exploit for CVE-2017-8779, a denial-of-service vulnerability in rpcbind/libtirpc. It sends crafted UDP packets to trigger excessive memory allocation, leading to a DoS condition.
This Metasploit module exploits a vulnerability in rpcbind/libtirpc (CVE-2017-8779) by sending malformed RPC packets to trigger excessive memory allocation, leading to a denial-of-service (DoS) condition.
References (19)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H