diff options
| author | Peter Korsgaard <peter@korsgaard.com> | 2017-05-15 23:01:24 +0200 |
|---|---|---|
| committer | Thomas Petazzoni <thomas.petazzoni@free-electrons.com> | 2017-05-16 09:24:01 +0200 |
| commit | 954509fb84cfbcf50a2f3020d817a118f7357d3a (patch) | |
| tree | 08d7f3e5b626b096fe4215ae39ecbce0b5d6372d /package/gcc | |
| parent | 1dd696ffe26fda96c315329e0dd3880273439e12 (diff) | |
| download | buildroot-954509fb84cfbcf50a2f3020d817a118f7357d3a.tar.gz buildroot-954509fb84cfbcf50a2f3020d817a118f7357d3a.zip | |
rpcbind: add upstream security fix for CVE-2017-8779
CVE-2017-8779: rpcbind through 0.2.4, LIBTIRPC through 1.0.1 and 1.0.2-rc
through 1.0.2-rc3, and NTIRPC through 1.4.3 do not consider the maximum RPC
data size during memory allocation for XDR strings, which allows remote
attackers to cause a denial of service (memory consumption with no
subsequent free) via a crafted UDP packet to port 111, aka rpcbomb.
For more details, see:
https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial-of-service-patches/
Backport upstream fix to version 0.2.3 and unconditionally include syslog.h
to fix a build issue when RPCBIND_DEBUG is disabled (which it is in
Buildroot).
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Diffstat (limited to 'package/gcc')
0 files changed, 0 insertions, 0 deletions
