ALAS-2017-841


Amazon Linux AMI Security Advisory: ALAS-2017-841
Advisory Release Date: 2017-06-06 22:50 Pacific
Severity: Important

Issue Overview:

It was found that due to the way rpcbind uses libtirpc (libntirpc), a memory
leak can occur when parsing specially crafted XDR messages. An attacker sending
thousands of messages to rpcbind could cause its memory usage to grow without
bound, eventually causing it to be terminated by the OOM killer. (CVE-2017-8779 )


Affected Packages:

rpcbind


Issue Correction:
Run yum update rpcbind to update your system.

New Packages:
i686:
    rpcbind-debuginfo-0.2.0-13.9.amzn1.i686
    rpcbind-0.2.0-13.9.amzn1.i686

src:
    rpcbind-0.2.0-13.9.amzn1.src

x86_64:
    rpcbind-debuginfo-0.2.0-13.9.amzn1.x86_64
    rpcbind-0.2.0-13.9.amzn1.x86_64