Hello
originally Common Vulnerabilities and Exposures assigned the CVE-2003-0028 identifier
to the following flaw:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0028
Testing original CVE-2003-0028 reproducer against recent rpcbind code,
resulted into an invalid pointer free flaw to be found:
[2] https://bugzilla.redhat.com/show_bug.cgi?id=948378#c0
Further issue context [3]:
--------------------------
An invalid pointer free flaw was found in the way server side code
implementation for connectionless RPC requests of libtirpc, a library
implementing Transport-Independent RPC (TI-RPC), (previously) performed
arguments retrieval (due to a regression in commit 82cc2e61 svc_dg_getargs()
routine callers would crash with invalid pointer free). A remote attacker
could issue a specially-crafted Sun RPC request that, when processed,
would lead to rpcbind daemon crash.
A different vulnerability than CVE-2003-0028.
[3] https://bugzilla.redhat.com/show_bug.cgi?id=948378#c13
Particular upstream patch:
[4] http://git.infradead.org/users/steved/libtirpc.git/commitdiff/a9f437119d79a438cb12e510f3cadd4060102c9f
Note: While the original CVE-2003-0028 issue has been reported to possibly
allow / lead to arbitrary code execution under certain circumstances,
the current (CVE-2013-1950) is believed to be able to cause (remote)
rpcbind daemon crash "only".
*** glibc detected *** /sbin/rpcbind: free(): invalid pointer: 0xbf7f494c ***
poll returned read fds < 6 >
======= Backtrace: =========
/lib/libc.so.6(-0xff84c1cf)[0x240e31]
/lib/libtirpc.so.1(xdr_bytes+0x9f)[0xb3ca9f]
/sbin/rpcbind(+0x5714)[0x631714]
/lib/libtirpc.so.1(+0x14ea4)[0xb36ea4]
/lib/libtirpc.so.1(+0x14e6e)[0xb36e6e]
/sbin/rpcbind(+0x591e)[0x63191e]
/sbin/rpcbind(pmap_service+0x174)[0x6344e4]
/lib/libtirpc.so.1(svc_getreq_common+0x2ae)[0xb3600e]
/lib/libtirpc.so.1(svc_getreq_poll+0x8f)[0xb360bf]
/sbin/rpcbind(+0x509b)[0x63109b]
/sbin/rpcbind(main+0x4dc)[0x62fd3c]
/lib/libc.so.6(__libc_start_main+0xe6)[0x1e6ce6]
/sbin/rpcbind(+0x21c1)[0x62e1c1]
--
Jan iankko Lieskovsky / Red Hat Security Response Team
