The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an invalid pointer.

The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2013-481:01 advisory.

    This package contains SunLib's implementation of transport-independent RPC (TI-RPC) documentation. This     library forms a piece of the base of Open Network Computing (ONC), and is derived directly from the     Solaris 2.3 source.
    TI-RPC is an enhanced version of TS-RPC that requires the UNIX System V Transport Layer Interface (TLI) or     an equivalent X/Open Transport Interface (XTI). TI-RPC is on-the-wire compatible with the TS-RPC, which is     supported by almost 70 vendors on all major operating systems. TS-RPC source code (RPCSRC 4.0) remains     available from several internet sites.
    Security issues fixed with this release:
     CVE-2013-1950     No information available at the time of writing, please use the CVE link below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an invalid pointer. (CVE-2013-1950)

A flaw was found in the way libtirpc decoded RPC requests. A specially crafted RPC request could cause libtirpc to attempt to free a buffer provided by an application using the library, even when the buffer was not dynamically allocated. This could cause an application using libtirpc, such as rpcbind, to crash. (CVE-2013-1950)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0884 advisory.

    [0.2.1-6_4]
    - Removed a svc_freeargs() call from svc_dg_freeargs() (bz 953735)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the way libtirpc decoded RPC requests. A specially- crafted RPC request could cause libtirpc to attempt to free a buffer provided by an application using the library, even when the buffer was not dynamically allocated. This could cause an application using libtirpc, such as rpcbind, to crash. (CVE-2013-1950)

All running applications using libtirpc must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0884 advisory.

    These packages provide a transport-independent RPC (remote procedure call)     implementation.

    A flaw was found in the way libtirpc decoded RPC requests. A     specially-crafted RPC request could cause libtirpc to attempt to free a     buffer provided by an application using the library, even when the buffer     was not dynamically allocated. This could cause an application using     libtirpc, such as rpcbind, to crash. (CVE-2013-1950)

    Red Hat would like to thank Michael Armstrong for reporting this issue.

    Users of libtirpc should upgrade to these updated packages, which contain a     backported patch to correct this issue. All running applications using     libtirpc must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated libtirpc packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

These packages provide a transport-independent RPC (remote procedure call) implementation.

A flaw was found in the way libtirpc decoded RPC requests. A specially crafted RPC request could cause libtirpc to attempt to free a buffer provided by an application using the library, even when the buffer was not dynamically allocated. This could cause an application using libtirpc, such as rpcbind, to crash. (CVE-2013-1950)

Red Hat would like to thank Michael Armstrong for reporting this issue.

Users of libtirpc should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libtirpc must be restarted for the update to take effect.

The RPC library has an integer overflow in the function xdrmem_getbytes(). 

An attacker may use this flaw to execute arbitrary code on this host with the privileges your RPC programs are running with (typically root), by sending a specially crafted request to them. 

Note that this issue affects Solaris, as well as Red Hat Enterprise Linux and Fedora.

Nessus used this flaw to crash the portmapper.

ID	Name	Product	Family	Severity
289011	MiracleLinux 4 : libtirpc-0.2.1-6.AXS4 (AXSA:2013-481:01)	Nessus	Miracle Linux Local Security Checks	high
88848	F5 Networks BIG-IP : libtirpc vulnerability (K19157044)	Nessus	F5 Networks Local Security Checks	medium
69757	Amazon Linux AMI : libtirpc (ALAS-2013-199)	Nessus	Amazon Linux Local Security Checks	medium
68830	Oracle Linux 6 : libtirpc (ELSA-2013-0884)	Nessus	Oracle Linux Local Security Checks	high
66709	Scientific Linux Security Update : libtirpc on SL6.x i386/srpm/x86_64 (20130530)	Nessus	Scientific Linux Local Security Checks	medium
66707	RHEL 6 : libtirpc (RHSA-2013:0884)	Nessus	Red Hat Local Security Checks	high
66702	CentOS 6 : libtirpc (CESA-2013:0884)	Nessus	CentOS Local Security Checks	medium
11420	Sun RPC XDR xdrmem_getbytes Function Remote Overflow	Nessus	RPC	critical

Detections

Analytics

CVE-2013-1950

high

Tenable Plugins

high

medium

medium

high

medium

high

medium

critical