Description
Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dietlibc | 0.20-0cvs20020808 | — |
| Debian 14 | glibc | 2.2.5-13 | — |
| Debian 14 | krb5 | 1.2.5-2 | — |
| Debian 13 | acm | 5.0-10 | — |
| Debian 13 | dietlibc | 0.20-0cvs20020808 | — |
| Debian 13 | glibc | 2.2.5-13 | — |
| Debian 13 | krb5 | 1.2.5-2 | — |
| Debian 13 | openafs | 1.2.6-1 | — |
| Debian 12 | acm | 5.0-10 | — |
| Debian 12 | dietlibc | 0.20-0cvs20020808 | — |
| Debian 12 | glibc | 2.2.5-13 | — |
| Debian 12 | krb5 | 1.2.5-2 | — |
| Debian 12 | openafs | 1.2.6-1 | — |
| Debian 3.0 | acm | 5.0-3.woody.1 | DSA-333 |
| Debian 3.0 | dietlibc | 0.12-2.4 | DSA-146 |
| Debian 3.0 | glibc | 2.2.5-11.1 | DSA-149 |
| Debian 3.0 | krb5 | 1.2.4-5woody1 | DSA-143 |
| Debian 3.0 | openafs | 1.2.3final2-6 | DSA-142 |
Advisories 6
- WID-SEC-2026-3877 HPE NonStop Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2026
- DSA-333 acm - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-143 krb5 - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-149 glibc - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-146 dietlibc - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-142 openafs - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- sunrpc-xdr-array-bo(9170) vdb-entry
- CA-2002-25 third-party-advisory
- HPSBTL0208-061 vendor-advisory
- 20020909 GLSA: glibc mailing-list
- DSA-146 vendor-advisory
- RHSA-2002:166 vendor-advisory
- HPSBUX0209-215 vendor-advisory
- DSA-143 vendor-advisory
- 20020731 Remote Buffer Overflow Vulnerability in Sun RPC third-party-advisory
- CLA-2002:515 vendor-advisory
- CLA-2002:535 vendor-advisory
- RHSA-2003:212 vendor-advisory
- MS02-057 vendor-advisory
- DSA-142 vendor-advisory
- IY34194 vendor-advisory
- RHSA-2002:167 vendor-advisory
- 20020803 OpenAFS Security Advisory 2002-001: Remote root vulnerability in OpenAFS servers mailing-list
- FreeBSD-SA-02:34.rpc vendor-advisory
- RHSA-2002:173 vendor-advisory
- 5356 vdb-entry
- 20020802 kerberos rpc xdr_array mailing-list
- 20020731 Remote Buffer Overflow Vulnerability in Sun RPC mailing-list
- 20020801 RPC analysis mailing-list
- VU#192995 third-party-advisory
- RHSA-2002:172 vendor-advisory
- oval:org.mitre.oval:def:4728 vdb-entry signature
- oval:org.mitre.oval:def:42 vdb-entry signature
- ESA-20021003-021 vendor-advisory
- oval:org.mitre.oval:def:9 vdb-entry signature
- MDKSA-2002:057 vendor-advisory
- DSA-149 vendor-advisory
- 20020802 MITKRB5-SA-2002-001: Remote root vulnerability in MIT krb5 admin mailing-list
- DSA-333 vendor-advisory
- RHSA-2003:168 vendor-advisory