rpcbind Package Vulnerability: Regression Causing Crashes
Summary
USN-4986-4: rpcbind regression. Affects rpcbind versions < 0.2.1-2ubuntu2.2+esm2. Fixed in 0.2.1-2ubuntu2.2+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rpcbind is a server that converts Remote Procedure Call (RPC) program numbers into universal addresses. It is essential for network services that rely on RPC, allowing clients to locate the appropriate server for their requests. This package is critical in various environments, especially those using network file systems and remote services. However, it has been found to have a vulnerability that can lead to crashes under certain conditions.
Vulnerability Detail
The vulnerability arises from rpcbind's improper handling of large data sizes. This flaw can be exploited by a remote attacker to cause rpcbind to consume excessive resources, leading to a denial of service. The issue was initially addressed in USN-4986-1, but a regression was introduced, causing rpcbind to crash in specific environments. This regression affects Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
How To Fix
Minimum fixed version
0.2.1-2ubuntu2.2+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rpcbindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the rpcbind service temporarily until the update can be applied. This can be done with the following command:
sudo systemctl stop rpcbind
sudo systemctl disable rpcbind
Conclusion
The rpcbind package has a critical vulnerability that can lead to service crashes and denial of service. It is essential to update to the patched versions provided for Ubuntu 14.04 ESM and 16.04 ESM to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for rpcbind →
FAQ
rpcbind is a server that helps clients find the appropriate server for Remote Procedure Call (RPC) services.
The vulnerability allows remote attackers to exploit rpcbind, causing it to consume excessive resources and potentially leading to a denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
As a temporary measure, you can disable the rpcbind service to prevent potential exploitation until you can apply the patch.
Detailed information can be found in the official advisory at https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-4986-4.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for rpcbind.
