CVE-2017-8779
HighPublic exploitrpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no…
Published May 4, 2017 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2017-8779, DEBIAN-CVE-2017-8779, DLA-936-1, DLA-937-1, DSA-3845-1, SUSE-SU-2017:1306-1, SUSE-SU-2017:1314-1, SUSE-SU-2017:1328-1, SUSE-SU-2017:1336-1, SUSE-SU-2017:1468-1, UBUNTU-CVE-2017-8779, USN-4986-1, USN-4986-2
Key Facts
Patch immediately- CVE-2017-8779 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Libtirpc (Libtirpc Project), Ntirpc (Ntirpc Project), Rpcbind (Rpcbind Project) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 81% probability of exploitation in the next 30 days.
- Fixed versions are available, including calamari-server 0:1.5.6-2.el7cp, ceph 1:10.2.7-27.el7cp, ceph-iscsi-cli 0:2.0-5.el7cp.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
81%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2017-8779 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.
Affected Products
173 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| LibtirpcLibtirpc Project | See advisory | 1.0.1 |
| NtirpcNtirpc Project | See advisory | 1.4.3 |
| RpcbindRpcbind Project | See advisory | 0.2.4 |
| lib32-libtirpcarch | See advisory | 1.0.1-2 |
| libtirpc-develamazon | See advisory | 0.2.4-0.8.14.amzn1 |
Patched Releases
calamari-server
0:1.5.6-2.el7cp
ceph
1:10.2.7-27.el7cp
ceph-iscsi-cli
0:2.0-5.el7cp
ceph-iscsi-config
0:2.0-4.el7cp
ceph-iscsi-tools
0:2.0-3.el7cp
lib32-libtirpc
1.0.1-2
libntirpc
0:1.4.3-4.el6rhs, 0:1.4.3-4.el7rhgs
Libtirpc
0:0.2.1-13.el6_9, 0:0.2.4-0.8.el7_3, 0.2.1-1.12.3, 0.2.1-13.el6_9, 0.2.2-5+deb7u1, 0.2.2-5ubuntu2.1, 0.2.3-13.3.1, 0.2.4-0.8.14.amzn1, 0.2.4-0.8.el7_3, 0.2.5-1.2, 0.2.5-1.2ubuntu0.1, 0.2.5-1+deb8u1, 0.2.5-1ubuntu0.1, 1.0.1-16.1, 1.0.1-2.3.1, 1.0.1-3, NA, 1.0.1
libtirpc-devel
0.2.1-1.12.3, 0.2.1-13.el6_9, 0.2.3-13.3.1, 0.2.4-0.8.14.amzn1, 0.2.4-0.8.el7_3, 1.0.1-16.1, 1.0.1-2.3.1
libtirpc-netconfig
1.0.1-16.1, 1.0.1-2.3.1
libtirpc1
0.2.1-1.12.3, 0.2.3-13.3.1
libtirpc1-32bit
0.2.3-13.3.1
libtirpc3
1.0.1-16.1, 1.0.1-2.3.1
libtirpc3-32bit
1.0.1-16.1, 1.0.1-2.3.1
nfs-ganesha
0:2.4.5-7.el7cp
Ntirpc
1.4.4-1, 1.4.3
pcp-pmda-lio
0:1.0-2.el7cp
python-crypto
0:2.6.1-1.2.el7cp
python-flask
1:0.10.1-5.el7
python-itsdangerous
0:0.23-1.el7
python-jinja2
0:2.7.2-2.el7cp
python-rtslib
0:2.1.fb64-0.1.20170301.git3637171.el7cp
python-werkzeug
0:0.9.1-1.el7
Rpcbind
0:0.2.0-13.el6_9, 0:0.2.0-38.el7_3, 0.1.6+git20080930-6.27.2, 0.2.0-13.9.amzn1, 0.2.0-13.el6_9, 0.2.0-38.el7_3, 0.2.0-8+deb7u2, 0.2.1_rc4-17.3.1, 0.2.1-2ubuntu2.2+esm1, 0.2.1-6+deb8u2, 0.2.3-0.2ubuntu0.16.04.1+esm1, 0.2.3-0.6, 0.2.3-0.6ubuntu0.18.04.2, 0.2.3-23.1, 0.2.3-3.3.1, 0.2.3-8.ph1, 0.2.4-3, 0.2.4-r0, 1.2.6-2.2, 0.2.4
targetcli
0:2.1.fb47-0.1.20170301.gitf632f38.el7cp
Timeline
Publicly disclosed
May 4, 2017
Last updated
Aug 4, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
- CWE-770 Allocation of Resources Without Limits or Throttling
References
- advisoryRHBA-2017:1497
- advisoryRHSA-2017:1262
- advisoryRHSA-2017:1263
- advisoryRHSA-2017:1267
- advisoryRHSA-2017:1268
FAQ
Common Questions.
rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC data size during memory allocation for XDR strings, which allows remote attackers to cause a denial of service (memory consumption with no subsequent free) via a crafted UDP packet to…
Affected: Libtirpc (Libtirpc Project); Ntirpc (Ntirpc Project); Rpcbind (Rpcbind Project), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including calamari-server 0:1.5.6-2.el7cp, ceph 1:10.2.7-27.el7cp, ceph-iscsi-cli 0:2.0-5.el7cp.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2017-8779 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo