Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.

According to its self-reported version number, the remote Junos Space version is prior to 17.2R1. It is, therefore, affected by multiple vulnerabilities.

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Utilities). Supported versions that are affected are 10 and 11.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via RPC to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris.

The remote host is affected by the vulnerability described in GLSA-201611-17 (RPCBind: Denial of Service)

    A use-after-free vulnerability was discovered in RPCBind&rsquo;s       svc_dodestroy function when trying to free a corrupted xprt->xp_netid       pointer.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

In rpcbind(8), netbuf structures are copied directly, which would result in two netbuf structures that reference to one shared address buffer. When one of the two netbuf structures is freed, access to the other netbuf structure would result in an undefined result that may crash the rpcbind(8) daemon. Impact : A remote attacker who can send specifically crafted packets to the rpcbind(8) daemon can cause it to crash, resulting in a denial of service condition.

This Solaris system is missing necessary patches to address a critical security update :

  - Vulnerability in the Solaris component of Oracle Sun     Systems Products Suite (subcomponent: Utilities).
    Supported versions that are affected are 10 and 11.3.
    Easily exploitable vulnerability allows unauthenticated     attacker with network access via RPC to compromise     Solaris. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Solaris.
    (CVE-2015-7236)

A use-after-free flaw related to the PMAP_CALLIT operation and TCP/UDP connections was discovered in rpcbind. A remote, unauthenticated attacker could possibly exploit this flaw to crash the rpcbind service (denial of service) by performing a series of UDP and TCP calls.

rpcbind-0.2.3-0.4.fc23 - Fixed Seg fault in PMAP_CALLIT code (bz1264351) rpcbind-0.2.3-0.3.fc22 - Fixed Seg fault in PMAP_CALLIT code (bz 1264351)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A use-after-free flaw related to the PMAP_CALLIT operation and TCP/UDP connections was discovered in rpcbind. A remote attacker could possibly exploit this flaw to crash the rpcbind service by performing a series of UDP and TCP calls. (CVE-2015-7236)

If the rpcbind service is running, it will be automatically restarted after installing this update.

Updated rpcbind packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The rpcbind utility is a server that converts RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine.

A use-after-free flaw related to the PMAP_CALLIT operation and TCP/UDP connections was discovered in rpcbind. A remote attacker could possibly exploit this flaw to crash the rpcbind service by performing a series of UDP and TCP calls. (CVE-2015-7236)

All rpcbind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. If the rpcbind service is running, it will be automatically restarted after installing this update.

From Red Hat Security Advisory 2016:0005 :

Updated rpcbind packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The rpcbind utility is a server that converts RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine.

A use-after-free flaw related to the PMAP_CALLIT operation and TCP/UDP connections was discovered in rpcbind. A remote attacker could possibly exploit this flaw to crash the rpcbind service by performing a series of UDP and TCP calls. (CVE-2015-7236)

All rpcbind users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. If the rpcbind service is running, it will be automatically restarted after installing this update.

A use-after-free security bug in rpcbind was fixed which could lead to a remote denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that rpcbind incorrectly handled certain memory structures. A remote attacker could use this issue to cause rpcbind to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A remotely triggerable use-after-free vulnerability was found in rpcbind, a server that converts RPC program numbers into universal addresses. A remote attacker can take advantage of this flaw to mount a denial of service (rpcbind crash).

A use-after-free vulnerability in rpcbind causing remotely triggerable crash was found. Rpcbind crashes in svc_dodestroy when trying to free a corrupted xprt->xp_netid pointer, which contains a sockaddr_in.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
108520	Juniper Junos Space < 17.2R1 Multiple Vulnerabilities (JSA10838)	Nessus	Junos Local Security Checks	critical
108255	Solaris 10 (x86) : 152265-01	Nessus	Solaris Local Security Checks	high
107782	Solaris 10 (sparc) : 152264-01	Nessus	Solaris Local Security Checks	high
95268	GLSA-201611-17 : RPCBind: Denial of Service	Nessus	Gentoo Local Security Checks	high
92896	FreeBSD : FreeBSD -- rpcbind(8) remote denial of service [REVISED] (0e5d6969-600a-11e6-a6c3-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high
90619	Oracle Solaris Critical Patch Update : apr2016_SRU11_3_4_5_0	Nessus	Solaris Local Security Checks	high
89840	Amazon Linux AMI : rpcbind (ALAS-2016-659)	Nessus	Amazon Linux Local Security Checks	high
89339	Fedora 22 : rpcbind-0.2.3-0.3.fc22 (2015-9eee2fbc78)	Nessus	Fedora Local Security Checks	high
89208	Fedora 23 : rpcbind-0.2.3-0.4.fc23 (2015-36b145bd37)	Nessus	Fedora Local Security Checks	high
87813	Scientific Linux Security Update : rpcbind on SL6.x, SL7.x i386/x86_64 (20160107)	Nessus	Scientific Linux Local Security Checks	high
87805	RHEL 6 / 7 : rpcbind (RHSA-2016:0005)	Nessus	Red Hat Local Security Checks	high
87792	Oracle Linux 6 / 7 : rpcbind (ELSA-2016-0005)	Nessus	Oracle Linux Local Security Checks	high
87778	CentOS 6 / 7 : rpcbind (CESA-2016:0005)	Nessus	CentOS Local Security Checks	high
86345	SUSE SLES11 Security Update : rpcbind (SUSE-SU-2015:1706-2)	Nessus	SuSE Local Security Checks	high
86344	SUSE SLED11 / SLES11 Security Update : rpcbind (SUSE-SU-2015:1706-1)	Nessus	SuSE Local Security Checks	high
86343	SUSE SLED12 Security Update : rpcbind (SUSE-SU-2015:1705-2)	Nessus	SuSE Local Security Checks	high
86342	SUSE SLES12 Security Update : rpcbind (SUSE-SU-2015:1705-1)	Nessus	SuSE Local Security Checks	high
86220	Ubuntu 14.04 LTS : rpcbind vulnerability (USN-2756-1)	Nessus	Ubuntu Local Security Checks	high
86108	Debian DSA-3366-1 : rpcbind - security update	Nessus	Debian Local Security Checks	high
86021	Debian DLA-311-1 : rpcbind security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-7236

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high