CVE-2017-8779

What it actually does

The flaw permits remote attackers to send a crafted UDP packet to port 111 that triggers unbounded memory allocation for XDR strings with no subsequent free, resulting in memory exhaustion and denial of service.

Why it matters to the business

Successful exploitation leads to service outages and degraded availability across affected systems and their 455 downstream dependents; the weaponized exploit and stable high EPSS indicate persistent remote DoS risk even years after disclosure.

How an attack unfolds

An attacker crafts a malicious UDP packet targeting the rpcbind service on port 111; the packet causes the server to allocate excessive memory for XDR strings without releasing it, exhausting resources and crashing the service. The maturity of available weaponized code lowers the barrier for widespread exploitation.

How to fix it

Upgrade rpcbind to a version beyond 0.2.4, LIBTIRPC beyond 1.0.1, NTIRPC beyond 1.4.3, and any affected downstream packages such as redis (Bitnami) to 5.0.14. Block or restrict UDP traffic to port 111 from untrusted networks where possible.

How to confirm the fix worked

Verify installed versions of rpcbind, LIBTIRPC, and NTIRPC against fixed releases; test that crafted UDP packets no longer produce unbounded memory growth; confirm service remains responsive under simulated load.

Typical attack path

1. Scan for exposed rpcbind services on UDP port 111
2. Send a single specially crafted UDP packet containing an oversized XDR string request
3. Trigger repeated or oversized memory allocations without deallocation
4. Observe resource exhaustion leading to denial of service

How to detect it

Inspect network logs for high volumes or anomalous patterns of UDP traffic destined to port 111; correlate with sudden spikes in memory consumption or process restarts of rpcbind or dependent services.

What your security team should do

• Prioritize patching all instances of affected rpc libraries and redis (Bitnami) to the listed fixed versions
• Implement network controls to limit exposure of port 111
• Monitor memory usage of rpcbind processes for anomalous growth
• Review downstream dependents for inherited exposure