Hello originally Common Vulnerabilities and Exposures assigned the CVE-2003-0028 identifier to the following flaw: [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0028 Testing original CVE-2003-0028 reproducer against recent rpcbind code, resulted into an invalid pointer free flaw to be found: [2] https://bugzilla.redhat.com/show_bug.cgi?id=948378#c0 Further issue context [3]: -------------------------- An invalid pointer free flaw was found in the way server side code implementation for connectionless RPC requests of libtirpc, a library implementing Transport-Independent RPC (TI-RPC), (previously) performed arguments retrieval (due to a regression in commit 82cc2e61 svc_dg_getargs() routine callers would crash with invalid pointer free). A remote attacker could issue a specially-crafted Sun RPC request that, when processed, would lead to rpcbind daemon crash. A different vulnerability than CVE-2003-0028. [3] https://bugzilla.redhat.com/show_bug.cgi?id=948378#c13 Particular upstream patch: [4] http://git.infradead.org/users/steved/libtirpc.git/commitdiff/a9f437119d79a438cb12e510f3cadd4060102c9f Note: While the original CVE-2003-0028 issue has been reported to possibly allow / lead to arbitrary code execution under certain circumstances, the current (CVE-2013-1950) is believed to be able to cause (remote) rpcbind daemon crash "only". *** glibc detected *** /sbin/rpcbind: free(): invalid pointer: 0xbf7f494c *** poll returned read fds < 6 > ======= Backtrace: ========= /lib/libc.so.6(-0xff84c1cf)[0x240e31] /lib/libtirpc.so.1(xdr_bytes+0x9f)[0xb3ca9f] /sbin/rpcbind(+0x5714)[0x631714] /lib/libtirpc.so.1(+0x14ea4)[0xb36ea4] /lib/libtirpc.so.1(+0x14e6e)[0xb36e6e] /sbin/rpcbind(+0x591e)[0x63191e] /sbin/rpcbind(pmap_service+0x174)[0x6344e4] /lib/libtirpc.so.1(svc_getreq_common+0x2ae)[0xb3600e] /lib/libtirpc.so.1(svc_getreq_poll+0x8f)[0xb360bf] /sbin/rpcbind(+0x509b)[0x63109b] /sbin/rpcbind(main+0x4dc)[0x62fd3c] /lib/libc.so.6(__libc_start_main+0xe6)[0x1e6ce6] /sbin/rpcbind(+0x21c1)[0x62e1c1] -- Jan iankko Lieskovsky / Red Hat Security Response Team