Vulnerability Description
The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an invalid pointer.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libtirpc Project | Libtirpc | <= 0.2.3 |
Related Weaknesses (CWE)
References
- http://git.infradead.org/users/steved/libtirpc.git/commitdiff/a9f437119d79a438cb
- http://rhn.redhat.com/errata/RHSA-2013-0884.html
- https://bugzilla.redhat.com/show_bug.cgi?id=948378
- http://git.infradead.org/users/steved/libtirpc.git/commitdiff/a9f437119d79a438cb
- http://rhn.redhat.com/errata/RHSA-2013-0884.html
- https://bugzilla.redhat.com/show_bug.cgi?id=948378
FAQ
What is CVE-2013-1950?
CVE-2013-1950 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an in...
How severe is CVE-2013-1950?
CVE-2013-1950 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-1950?
Check the references section above for vendor advisories and patch information. Affected products include: Libtirpc Project Libtirpc.