CVE-2003-0028
published 2003-03-25CVE-2003-0028: Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC…
PriorityP338high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
15.03%
96.3th percentile
Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.
Affected
154 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cray | unicos | — | — |
| cray | unicos | — | — |
| cray | unicos | — | — |
| cray | unicos | — | — |
| cray | unicos | — | — |
| cray | unicos | — | — |
| cray | unicos | — | — |
| cray | unicos | — | — |
| cray | unicos | — | — |
| cray | unicos | — | — |
| debian | dietlibc | < dietlibc 0.22-2 (bookworm) | dietlibc 0.22-2 (bookworm) |
| debian | glibc | < dietlibc 0.22-2 (bookworm) | dietlibc 0.22-2 (bookworm) |
| debian | krb5 | < dietlibc 0.22-2 (bookworm) | dietlibc 0.22-2 (bookworm) |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| gnu | glibc | — | — |
Detection & IOCsextracted from sources · hover to see the quote
port111/tcp
snort
alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap proxy integer overflow attempt TCP"; flow:established,to_server; content:"|00 01 86 A0 00|"; depth:5; offset:16; content:"|00 00 00 05|"; within:4; distance:3; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,2048,12,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,7123; reference:cve,2003-0028; classtype:rpc-portmap-decode; sid:2102093; rev:7; metadata:created_at 2010_09_23, cve CVE_2003_0028, confidence Medium, signature_severity Informational, updated_at 2024_03_08;)
bytes
|00 01 86 A0 00| at offset 16, depth 5
bytes
|00 00 00 05| within 4, distance 3 (after first content match)
bytes
|00 00 00 00| at offset 8, depth 4
- →Target TCP port 111 (RPC portmapper) for inbound connections from external networks; look for established flows to server matching the RPC portmap proxy integer overflow byte pattern.
- →Flag RPC requests where the byte_test detects a length field value greater than 2048 at relative offset 12, indicating a potential integer overflow in xdrmem_getbytes().
- →The vulnerability is triggered via certain integer values in XDR length fields sent to SunRPC-derived services (libnsl, libc, glibc, dietlibc); monitor RPC portmapper traffic for anomalously large length field values. ↗
- ·The Snort rule targets the RPC portmapper (port 111/TCP) specifically for the proxy integer overflow vector; other XDR-consuming services on different ports may also be vulnerable but are not covered by this rule.
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2003-03-19·CVSS 9.8
CVE-2003-0028 [CRITICAL] security flaw
security flaw
Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.
Debian
CVE-2003-0028: dietlibc - Integer overflow in the xdrmem_getbytes() function, and possibly other functions...
vendor_debian·2003·CVSS 9.8
CVE-2003-0028 [CRITICAL] CVE-2003-0028: dietlibc - Integer overflow in the xdrmem_getbytes() function, and possibly other functions...
Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.
Scope: local
bookworm: resolved (fixed in 0.22-2)
bullseye: resolved (fixed in 0.22-2)
forky: resolved (fixed in 0.22-2)
sid: resolved (fixed in 0.22-2)
trixie: resolved (fixed in 0.22-2)
Suricata
GPL RPC portmap proxy integer overflow attempt TCP
suricata·2010-09-23
CVE-2003-0028 GPL RPC portmap proxy integer overflow attempt TCP
GPL RPC portmap proxy integer overflow attempt TCP
Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap proxy integer overflow attempt TCP"; flow:established,to_server; content:"|00 01 86 A0 00|"; depth:5; offset:16; content:"|00 00 00 05|"; within:4; distance:3; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,2048,12,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,7123; reference:cve,2003-0028; classtype:rpc-portmap-decode; sid:2102093; rev:7; metadata:created_at 2010_09_23, cve CVE_2003_0028, confidence Medium, signature_severity Informational, updated_at 2024_03_08;)
No public exploits indexed.
Bugzilla
CVE-2003-0028 security flaw
bugzilla·2018-08-16·CVSS 9.8
CVE-2003-0028 [CRITICAL] CVE-2003-0028 security flaw
CVE-2003-0028 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.
Bugzilla
CVE-2013-1950 libtirpc: invalid pointer free leads to rpcbind daemon crash
bugzilla·2013-04-04·CVSS 4.3
CVE-2013-1950 [MEDIUM] CVE-2013-1950 libtirpc: invalid pointer free leads to rpcbind daemon crash
CVE-2013-1950 libtirpc: invalid pointer free leads to rpcbind daemon crash
The Nessus plugin for Sun RPC XDR xdrmem_getbytes Function Remote Overflow [1] causes rpcbind to crash due to freeing an invalid pointer.
*** glibc detected *** /sbin/rpcbind: free(): invalid pointer: 0xbf7f494c ***
poll returned read fds
======= Backtrace: =========
/lib/libc.so.6(-0xff84c1cf)[0x240e31]
/lib/libtirpc.so.1(xdr_bytes+0x9f)[0xb3ca9f]
/sbin/rpcbind(+0x5714)[0x631714]
/lib/libtirpc.so.1(+0x14ea4)[0xb36ea4]
/lib/libtirpc.so.1(+0x14e6e)[0xb36e6e]
/sbin/rpcbind(+0x591e)[0x63191e]
/sbin/rpcbind(pmap_service+0x174)[0x6344e4]
/lib/libtirpc.so.1(svc_getreq_common+0x2ae)[0xb3600e]
/lib/libtirpc.so.1(svc_getreq_poll+0x8f)[0xb360bf]
/sbin/rpcbind(+0x509b)[0x63109b]
/sbin/rpcbind(main+0x4dc)[0x62fd3c]
/lib/libc.
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-008.txt.aschttp://archives.neohapsis.com/archives/vulnwatch/2003-q1/0140.htmlhttp://marc.info/?l=bugtraq&m=104810574423662&w=2http://marc.info/?l=bugtraq&m=104811415301340&w=2http://marc.info/?l=bugtraq&m=104860855114117&w=2http://marc.info/?l=bugtraq&m=104878237121402&w=2http://marc.info/?l=bugtraq&m=105362148313082&w=2http://www.cert.org/advisories/CA-2003-10.htmlhttp://www.debian.org/security/2003/dsa-266http://www.debian.org/security/2003/dsa-272http://www.debian.org/security/2003/dsa-282http://www.eeye.com/html/Research/Advisories/AD20030318.htmlhttp://www.kb.cert.org/vuls/id/516825http://www.linuxsecurity.com/advisories/engarde_advisory-3024.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2003:037http://www.novell.com/linux/security/advisories/2003_027_glibc.htmlhttp://www.redhat.com/support/errata/RHSA-2003-051.htmlhttp://www.redhat.com/support/errata/RHSA-2003-052.htmlhttp://www.redhat.com/support/errata/RHSA-2003-089.htmlhttp://www.redhat.com/support/errata/RHSA-2003-091.htmlhttp://www.securityfocus.com/archive/1/315638/30/25430/threadedhttp://www.securityfocus.com/archive/1/316931/30/25250/threadedhttp://www.securityfocus.com/archive/1/316960/30/25250/threadedhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A230https://security.netapp.com/advisory/ntap-20150122-0002/ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-008.txt.aschttp://archives.neohapsis.com/archives/vulnwatch/2003-q1/0140.htmlhttp://marc.info/?l=bugtraq&m=104810574423662&w=2http://marc.info/?l=bugtraq&m=104811415301340&w=2http://marc.info/?l=bugtraq&m=104860855114117&w=2http://marc.info/?l=bugtraq&m=104878237121402&w=2http://marc.info/?l=bugtraq&m=105362148313082&w=2http://www.cert.org/advisories/CA-2003-10.htmlhttp://www.debian.org/security/2003/dsa-266http://www.debian.org/security/2003/dsa-272http://www.debian.org/security/2003/dsa-282http://www.eeye.com/html/Research/Advisories/AD20030318.htmlhttp://www.kb.cert.org/vuls/id/516825http://www.linuxsecurity.com/advisories/engarde_advisory-3024.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2003:037http://www.novell.com/linux/security/advisories/2003_027_glibc.htmlhttp://www.redhat.com/support/errata/RHSA-2003-051.htmlhttp://www.redhat.com/support/errata/RHSA-2003-052.htmlhttp://www.redhat.com/support/errata/RHSA-2003-089.htmlhttp://www.redhat.com/support/errata/RHSA-2003-091.htmlhttp://www.securityfocus.com/archive/1/315638/30/25430/threadedhttp://www.securityfocus.com/archive/1/316931/30/25250/threadedhttp://www.securityfocus.com/archive/1/316960/30/25250/threadedhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A230https://security.netapp.com/advisory/ntap-20150122-0002/
2003-03-25
Published