Vulnerabilites related to memcachedb - memcached
CVE-2009-2415 (GCVE-0-2009-2415)
Vulnerability from cvelistv5
Published
2009-08-10 18:00
Modified
2024-08-07 05:52
Severity ?
CWE
  • n/a
Summary
Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:52:14.675Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-1853",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1853"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://security.debian.org/pool/updates/main/m/memcached/memcached_1.2.2-1+lenny1.diff.gz"
          },
          {
            "name": "56906",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/56906"
          },
          {
            "name": "35989",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/35989"
          },
          {
            "name": "36133",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36133"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://security.debian.org/pool/updates/main/m/memcached/memcached_1.1.12-1+etch1.diff.gz"
          },
          {
            "name": "37729",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37729"
          },
          {
            "name": "FEDORA-2009-12552",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00836.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2009-08-15T09:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "DSA-1853",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1853"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://security.debian.org/pool/updates/main/m/memcached/memcached_1.2.2-1+lenny1.diff.gz"
        },
        {
          "name": "56906",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/56906"
        },
        {
          "name": "35989",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/35989"
        },
        {
          "name": "36133",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36133"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://security.debian.org/pool/updates/main/m/memcached/memcached_1.1.12-1+etch1.diff.gz"
        },
        {
          "name": "37729",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37729"
        },
        {
          "name": "FEDORA-2009-12552",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00836.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-2415",
    "datePublished": "2009-08-10T18:00:00",
    "dateReserved": "2009-07-09T00:00:00",
    "dateUpdated": "2024-08-07T05:52:14.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-1152 (GCVE-0-2010-1152)
Vulnerability from cvelistv5
Published
2010-04-12 18:00
Modified
2024-08-07 01:14
Severity ?
CWE
  • n/a
Summary
memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation. NOTE: some of these details are obtained from third party information.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T01:14:06.333Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20100408 Re: CVE request -- memcached",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=oss-security\u0026m=127075341110616\u0026w=2"
          },
          {
            "name": "39306",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/39306"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://github.com/memcached/memcached/commit/d9cd01ede97f4145af9781d448c62a3318952719"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://blogs.sun.com/security/entry/input_validation_vulnerability_in_memcached"
          },
          {
            "name": "[oss-security] 20100408 CVE request -- memcached",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=oss-security\u0026m=127074597129559\u0026w=2"
          },
          {
            "name": "SUSE-SR:2010:013",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
          },
          {
            "name": "ADV-2011-0442",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0442"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://github.com/memcached/memcached/commit/75cc83685e103bc8ba380a57468c8f04413033f9"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/memcached/issues/detail?id=102"
          },
          {
            "name": "[oss-security] 20100408 Re: CVE request -- memcached",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=oss-security\u0026m=127075808518733\u0026w=2"
          },
          {
            "name": "1023839",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1023839"
          },
          {
            "name": "SUSE-SR:2010:012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-10-27T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation.  NOTE: some of these details are obtained from third party information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2010-04-15T09:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[oss-security] 20100408 Re: CVE request -- memcached",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=oss-security\u0026m=127075341110616\u0026w=2"
        },
        {
          "name": "39306",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/39306"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://github.com/memcached/memcached/commit/d9cd01ede97f4145af9781d448c62a3318952719"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://blogs.sun.com/security/entry/input_validation_vulnerability_in_memcached"
        },
        {
          "name": "[oss-security] 20100408 CVE request -- memcached",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=oss-security\u0026m=127074597129559\u0026w=2"
        },
        {
          "name": "SUSE-SR:2010:013",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
        },
        {
          "name": "ADV-2011-0442",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0442"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://github.com/memcached/memcached/commit/75cc83685e103bc8ba380a57468c8f04413033f9"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://code.google.com/p/memcached/issues/detail?id=102"
        },
        {
          "name": "[oss-security] 20100408 Re: CVE request -- memcached",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=oss-security\u0026m=127075808518733\u0026w=2"
        },
        {
          "name": "1023839",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1023839"
        },
        {
          "name": "SUSE-SR:2010:012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2010-1152",
    "datePublished": "2010-04-12T18:00:00",
    "dateReserved": "2010-03-29T00:00:00",
    "dateUpdated": "2024-08-07T01:14:06.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-1255 (GCVE-0-2009-1255)
Vulnerability from cvelistv5
Published
2009-04-30 20:00
Modified
2024-08-07 05:04
Severity ?
CWE
  • n/a
Summary
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
References
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html vendor-advisory, x_refsource_FEDORA
https://exchange.xforce.ibmcloud.com/vulnerabilities/50221 vdb-entry, x_refsource_XF
http://www.mandriva.com/security/advisories?name=MDVSA-2009:105 vendor-advisory, x_refsource_MANDRIVA
http://www.positronsecurity.com/advisories/2009-001.html x_refsource_MISC
http://www.securitytracker.com/id?1022140 vdb-entry, x_refsource_SECTRACK
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.html vendor-advisory, x_refsource_FEDORA
http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.c x_refsource_CONFIRM
http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html mailing-list, x_refsource_FULLDISC
http://www.securityfocus.com/archive/1/503064/100/0/threaded mailing-list, x_refsource_BUGTRAQ
http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e x_refsource_CONFIRM
http://secunia.com/advisories/35175 third-party-advisory, x_refsource_SECUNIA
http://osvdb.org/54127 vdb-entry, x_refsource_OSVDB
http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98 x_refsource_CONFIRM
http://code.google.com/p/memcachedb/source/detail?r=98 x_refsource_CONFIRM
http://www.securityfocus.com/bid/34756 vdb-entry, x_refsource_BID
http://www.vupen.com/english/advisories/2009/1196 vdb-entry, x_refsource_VUPEN
http://secunia.com/advisories/34932 third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/34915 third-party-advisory, x_refsource_SECUNIA
http://www.vupen.com/english/advisories/2009/1197 vdb-entry, x_refsource_VUPEN
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:04:49.298Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2009-4542",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html"
          },
          {
            "name": "memcachedb-procselfmaps-info-disclosure(50221)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50221"
          },
          {
            "name": "MDVSA-2009:105",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:105"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.positronsecurity.com/advisories/2009-001.html"
          },
          {
            "name": "1022140",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022140"
          },
          {
            "name": "FEDORA-2009-4199",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c"
          },
          {
            "name": "20090428 Positron Security Advisory #2009-001: Memcached and MemcacheDB ASLR Bypass Weakness",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html"
          },
          {
            "name": "20090428 Positron Security Advisory #2009-001: Memcached and MemcacheDB ASLR Bypass Weakness",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/503064/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e"
          },
          {
            "name": "35175",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/35175"
          },
          {
            "name": "54127",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/54127"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/memcachedb/source/detail?r=98"
          },
          {
            "name": "34756",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34756"
          },
          {
            "name": "ADV-2009-1196",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1196"
          },
          {
            "name": "34932",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34932"
          },
          {
            "name": "34915",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34915"
          },
          {
            "name": "ADV-2009-1197",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/1197"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-04-28T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon\u0027s TCP port."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "FEDORA-2009-4542",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html"
        },
        {
          "name": "memcachedb-procselfmaps-info-disclosure(50221)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50221"
        },
        {
          "name": "MDVSA-2009:105",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:105"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.positronsecurity.com/advisories/2009-001.html"
        },
        {
          "name": "1022140",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022140"
        },
        {
          "name": "FEDORA-2009-4199",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c"
        },
        {
          "name": "20090428 Positron Security Advisory #2009-001: Memcached and MemcacheDB ASLR Bypass Weakness",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html"
        },
        {
          "name": "20090428 Positron Security Advisory #2009-001: Memcached and MemcacheDB ASLR Bypass Weakness",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/503064/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e"
        },
        {
          "name": "35175",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/35175"
        },
        {
          "name": "54127",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/54127"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://code.google.com/p/memcachedb/source/detail?r=98"
        },
        {
          "name": "34756",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34756"
        },
        {
          "name": "ADV-2009-1196",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1196"
        },
        {
          "name": "34932",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34932"
        },
        {
          "name": "34915",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34915"
        },
        {
          "name": "ADV-2009-1197",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/1197"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-1255",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon\u0027s TCP port."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2009-4542",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html"
            },
            {
              "name": "memcachedb-procselfmaps-info-disclosure(50221)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50221"
            },
            {
              "name": "MDVSA-2009:105",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:105"
            },
            {
              "name": "http://www.positronsecurity.com/advisories/2009-001.html",
              "refsource": "MISC",
              "url": "http://www.positronsecurity.com/advisories/2009-001.html"
            },
            {
              "name": "1022140",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022140"
            },
            {
              "name": "FEDORA-2009-4199",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.html"
            },
            {
              "name": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c",
              "refsource": "CONFIRM",
              "url": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c"
            },
            {
              "name": "20090428 Positron Security Advisory #2009-001: Memcached and MemcacheDB ASLR Bypass Weakness",
              "refsource": "FULLDISC",
              "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html"
            },
            {
              "name": "20090428 Positron Security Advisory #2009-001: Memcached and MemcacheDB ASLR Bypass Weakness",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/503064/100/0/threaded"
            },
            {
              "name": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e",
              "refsource": "CONFIRM",
              "url": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e"
            },
            {
              "name": "35175",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/35175"
            },
            {
              "name": "54127",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/54127"
            },
            {
              "name": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98",
              "refsource": "CONFIRM",
              "url": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98"
            },
            {
              "name": "http://code.google.com/p/memcachedb/source/detail?r=98",
              "refsource": "CONFIRM",
              "url": "http://code.google.com/p/memcachedb/source/detail?r=98"
            },
            {
              "name": "34756",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34756"
            },
            {
              "name": "ADV-2009-1196",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1196"
            },
            {
              "name": "34932",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34932"
            },
            {
              "name": "34915",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34915"
            },
            {
              "name": "ADV-2009-1197",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/1197"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-1255",
    "datePublished": "2009-04-30T20:00:00",
    "dateReserved": "2009-04-07T00:00:00",
    "dateUpdated": "2024-08-07T05:04:49.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-1494 (GCVE-0-2009-1494)
Vulnerability from cvelistv5
Published
2009-04-30 20:00
Modified
2024-08-07 05:13
Severity ?
CWE
  • n/a
Summary
The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:13:25.564Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://memcached.googlecode.com/files/memcached-1.2.8.tar.gz"
          },
          {
            "name": "memcached-processstat-info-disclosure(50444)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50444"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/memcachedb/source/detail?r=98"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-04-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon\u0027s TCP port."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://memcached.googlecode.com/files/memcached-1.2.8.tar.gz"
        },
        {
          "name": "memcached-processstat-info-disclosure(50444)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50444"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://code.google.com/p/memcachedb/source/detail?r=98"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-1494",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon\u0027s TCP port."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98",
              "refsource": "MISC",
              "url": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98"
            },
            {
              "name": "http://memcached.googlecode.com/files/memcached-1.2.8.tar.gz",
              "refsource": "MISC",
              "url": "http://memcached.googlecode.com/files/memcached-1.2.8.tar.gz"
            },
            {
              "name": "memcached-processstat-info-disclosure(50444)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50444"
            },
            {
              "name": "http://code.google.com/p/memcachedb/source/detail?r=98",
              "refsource": "MISC",
              "url": "http://code.google.com/p/memcachedb/source/detail?r=98"
            },
            {
              "name": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c",
              "refsource": "MISC",
              "url": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c"
            },
            {
              "name": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e",
              "refsource": "MISC",
              "url": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-1494",
    "datePublished": "2009-04-30T20:00:00",
    "dateReserved": "2009-04-30T00:00:00",
    "dateUpdated": "2024-08-07T05:13:25.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2009-08-10 18:30
Modified
2025-04-09 00:30
Severity ?
Summary
Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows.
References
secalert@redhat.comhttp://osvdb.org/56906
secalert@redhat.comhttp://secunia.com/advisories/36133
secalert@redhat.comhttp://secunia.com/advisories/37729
secalert@redhat.comhttp://security.debian.org/pool/updates/main/m/memcached/memcached_1.1.12-1+etch1.diff.gz
secalert@redhat.comhttp://security.debian.org/pool/updates/main/m/memcached/memcached_1.2.2-1+lenny1.diff.gz
secalert@redhat.comhttp://www.debian.org/security/2009/dsa-1853
secalert@redhat.comhttp://www.securityfocus.com/bid/35989
secalert@redhat.comhttps://www.redhat.com/archives/fedora-package-announce/2009-December/msg00836.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/56906
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36133
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37729
af854a3a-2127-422b-91ae-364da2661108http://security.debian.org/pool/updates/main/m/memcached/memcached_1.1.12-1+etch1.diff.gz
af854a3a-2127-422b-91ae-364da2661108http://security.debian.org/pool/updates/main/m/memcached/memcached_1.2.2-1+lenny1.diff.gz
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2009/dsa-1853
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/35989
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00836.html
Impacted products
Vendor Product Version
memcachedb memcached 1.1.12
memcachedb memcached 1.2.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "84BF997C-79FB-41F3-A4F5-455652BB2015",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8789BF3-CA97-4DA2-99C4-53350CEEBB62",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples desbordamientos de entero en memcached v1.1.12 y v1.2.2 permiten a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de vectores de ataque que involucran los atributos de longitud que provocan desbordamientos de b\u00fafer basados en memoria din\u00e1mica."
    }
  ],
  "id": "CVE-2009-2415",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-08-10T18:30:00.327",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://osvdb.org/56906"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/36133"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/37729"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://security.debian.org/pool/updates/main/m/memcached/memcached_1.1.12-1+etch1.diff.gz"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://security.debian.org/pool/updates/main/m/memcached/memcached_1.2.2-1+lenny1.diff.gz"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.debian.org/security/2009/dsa-1853"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/35989"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00836.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/56906"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/36133"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/37729"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.debian.org/pool/updates/main/m/memcached/memcached_1.1.12-1+etch1.diff.gz"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.debian.org/pool/updates/main/m/memcached/memcached_1.2.2-1+lenny1.diff.gz"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2009/dsa-1853"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/35989"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00836.html"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-189"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2010-04-12 18:30
Modified
2025-04-11 00:51
Severity ?
Summary
memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation. NOTE: some of these details are obtained from third party information.
References
secalert@redhat.comhttp://blogs.sun.com/security/entry/input_validation_vulnerability_in_memcached
secalert@redhat.comhttp://code.google.com/p/memcached/issues/detail?id=102Exploit
secalert@redhat.comhttp://github.com/memcached/memcached/commit/75cc83685e103bc8ba380a57468c8f04413033f9Patch
secalert@redhat.comhttp://github.com/memcached/memcached/commit/d9cd01ede97f4145af9781d448c62a3318952719Patch
secalert@redhat.comhttp://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
secalert@redhat.comhttp://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
secalert@redhat.comhttp://marc.info/?l=oss-security&m=127074597129559&w=2Patch
secalert@redhat.comhttp://marc.info/?l=oss-security&m=127075341110616&w=2Patch
secalert@redhat.comhttp://marc.info/?l=oss-security&m=127075808518733&w=2Patch
secalert@redhat.comhttp://secunia.com/advisories/39306Vendor Advisory
secalert@redhat.comhttp://securitytracker.com/id?1023839
secalert@redhat.comhttp://www.vupen.com/english/advisories/2011/0442
af854a3a-2127-422b-91ae-364da2661108http://blogs.sun.com/security/entry/input_validation_vulnerability_in_memcached
af854a3a-2127-422b-91ae-364da2661108http://code.google.com/p/memcached/issues/detail?id=102Exploit
af854a3a-2127-422b-91ae-364da2661108http://github.com/memcached/memcached/commit/75cc83685e103bc8ba380a57468c8f04413033f9Patch
af854a3a-2127-422b-91ae-364da2661108http://github.com/memcached/memcached/commit/d9cd01ede97f4145af9781d448c62a3318952719Patch
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=oss-security&m=127074597129559&w=2Patch
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=oss-security&m=127075341110616&w=2Patch
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=oss-security&m=127075808518733&w=2Patch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/39306Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1023839
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2011/0442
Impacted products
Vendor Product Version
memcachedb memcached *
memcachedb memcached 0.0.1
memcachedb memcached 0.0.2
memcachedb memcached 0.0.3
memcachedb memcached 0.0.4
memcachedb memcached 0.1.0
memcachedb memcached 0.1.1
memcachedb memcached 1.0.0
memcachedb memcached 1.0.1
memcachedb memcached 1.0.2
memcachedb memcached 1.0.3
memcachedb memcached 1.0.4
memcachedb memcached 1.1.0
memcachedb memcached 1.1.12
memcachedb memcached 1.2.0
memcachedb memcached 1.2.0
memcachedb memcached 1.2.1
memcachedb memcached 1.2.2
memcachedb memcached 1.2.8
memcachedb memcached 1.4.0
memcachedb memcached 1.4.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A05D93F0-7569-4465-99B4-09BB7333F875",
              "versionEndIncluding": "1.4.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F664659-721C-4387-A06C-AD30DD9AF762",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "18A83632-06E4-4978-909A-5E145F7A654F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A511459-F98A-4192-8E79-24766D296A47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DC3886A-4C1B-49B9-A334-E9A1C8CA5309",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD764B57-6985-4DD2-BA3C-09912715A56A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E433DCE9-8C2E-47AC-907E-8306D322D0A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.0.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "8164AFC1-6320-44C1-8872-9C26A5E1C173",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.0.1:beta:*:*:*:*:*:*",
              "matchCriteriaId": "6397D3FD-EF1F-4B0C-BA6C-26131820A653",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.0.2:beta:*:*:*:*:*:*",
              "matchCriteriaId": "2616A383-92BE-4FD2-8A62-8A2CF1F69830",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F500EE98-0AAA-4C9E-91DF-313E6812CC50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF0C217E-B2E4-472A-AE6A-C95D73C8FE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.1.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "07FCB8CB-1434-4486-858D-BC509246231D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "84BF997C-79FB-41F3-A4F5-455652BB2015",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8932E944-B3D8-489C-89C2-0A870AF51428",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.2.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "6BE87DDD-FF8E-47B2-A30B-7C32ADA6C02A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.2.1:beta:*:*:*:*:*:*",
              "matchCriteriaId": "A76FC002-9B7C-4F3D-A2E7-E416CD6C6336",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8789BF3-CA97-4DA2-99C4-53350CEEBB62",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "45A81180-5F55-4E8B-B4AF-8B646D694945",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D286241F-9DAE-43A1-80CE-701C7369F41D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "431884EE-1F51-4BAF-931D-27BAB9AD3317",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "memcached.c en memcached anterior a v1.4.3 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (fallo o bloqueo del demonio) a trav\u00e9s de una l\u00ednea larga que dispara la asignaci\u00f3n de memoria excesiva. NOTA: algunos de estos detalles han sido obtenidos de informaci\u00f3n de terceros."
    }
  ],
  "id": "CVE-2010-1152",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-04-12T18:30:00.837",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://blogs.sun.com/security/entry/input_validation_vulnerability_in_memcached"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit"
      ],
      "url": "http://code.google.com/p/memcached/issues/detail?id=102"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://github.com/memcached/memcached/commit/75cc83685e103bc8ba380a57468c8f04413033f9"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://github.com/memcached/memcached/commit/d9cd01ede97f4145af9781d448c62a3318952719"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=oss-security\u0026m=127074597129559\u0026w=2"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=oss-security\u0026m=127075341110616\u0026w=2"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=oss-security\u0026m=127075808518733\u0026w=2"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/39306"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://securitytracker.com/id?1023839"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.vupen.com/english/advisories/2011/0442"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://blogs.sun.com/security/entry/input_validation_vulnerability_in_memcached"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://code.google.com/p/memcached/issues/detail?id=102"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://github.com/memcached/memcached/commit/75cc83685e103bc8ba380a57468c8f04413033f9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://github.com/memcached/memcached/commit/d9cd01ede97f4145af9781d448c62a3318952719"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=oss-security\u0026m=127074597129559\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=oss-security\u0026m=127075341110616\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://marc.info/?l=oss-security\u0026m=127075808518733\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/39306"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1023839"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2011/0442"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2009-04-30 20:30
Modified
2025-04-09 00:30
Severity ?
Summary
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
References
cve@mitre.orghttp://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html
cve@mitre.orghttp://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98
cve@mitre.orghttp://code.google.com/p/memcachedb/source/detail?r=98
cve@mitre.orghttp://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.cExploit, Patch
cve@mitre.orghttp://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e
cve@mitre.orghttp://osvdb.org/54127
cve@mitre.orghttp://secunia.com/advisories/34915Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/34932Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/35175
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2009:105
cve@mitre.orghttp://www.positronsecurity.com/advisories/2009-001.htmlExploit
cve@mitre.orghttp://www.securityfocus.com/archive/1/503064/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/34756
cve@mitre.orghttp://www.securitytracker.com/id?1022140
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/1196Vendor Advisory
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/1197Vendor Advisory
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/50221
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.html
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html
af854a3a-2127-422b-91ae-364da2661108http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98
af854a3a-2127-422b-91ae-364da2661108http://code.google.com/p/memcachedb/source/detail?r=98
af854a3a-2127-422b-91ae-364da2661108http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.cExploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/54127
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34915Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/34932Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/35175
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2009:105
af854a3a-2127-422b-91ae-364da2661108http://www.positronsecurity.com/advisories/2009-001.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/503064/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/34756
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1022140
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1196Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/1197Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/50221
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.html
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html
Impacted products
Vendor Product Version
memcachedb memcached *
memcachedb memcached 0.0.1
memcachedb memcached 0.0.2
memcachedb memcached 0.0.3
memcachedb memcached 0.0.4
memcachedb memcached 0.1.0
memcachedb memcached 0.1.1
memcachedb memcached 1.0.0
memcachedb memcached 1.0.1
memcachedb memcached 1.0.2
memcachedb memcached 1.0.3
memcachedb memcached 1.0.4
memcachedb memcached 1.1.0
memcachedb memcached 1.2.0
memcachedb memcached 1.2.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "82B62E56-CCC2-4239-8B5C-81FF1D6BF32F",
              "versionEndIncluding": "1.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F664659-721C-4387-A06C-AD30DD9AF762",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "18A83632-06E4-4978-909A-5E145F7A654F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A511459-F98A-4192-8E79-24766D296A47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DC3886A-4C1B-49B9-A334-E9A1C8CA5309",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD764B57-6985-4DD2-BA3C-09912715A56A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E433DCE9-8C2E-47AC-907E-8306D322D0A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.0.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "8164AFC1-6320-44C1-8872-9C26A5E1C173",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.0.1:beta:*:*:*:*:*:*",
              "matchCriteriaId": "6397D3FD-EF1F-4B0C-BA6C-26131820A653",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.0.2:beta:*:*:*:*:*:*",
              "matchCriteriaId": "2616A383-92BE-4FD2-8A62-8A2CF1F69830",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F500EE98-0AAA-4C9E-91DF-313E6812CC50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF0C217E-B2E4-472A-AE6A-C95D73C8FE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.1.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "07FCB8CB-1434-4486-858D-BC509246231D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.2.0:beta:*:*:*:*:*:*",
              "matchCriteriaId": "6BE87DDD-FF8E-47B2-A30B-7C32ADA6C02A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.2.1:beta:*:*:*:*:*:*",
              "matchCriteriaId": "A76FC002-9B7C-4F3D-A2E7-E416CD6C6336",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon\u0027s TCP port."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n process_stat en (1) Memcached antes de v1.2.8 y (2) MemcacheDB v1.2.0 revela (a) el contenido de /proc/self/maps en respuesta a un comando stats maps (estadisticas de mapas) y (b) las estad\u00edsticas de la asignaci\u00f3n de memoria en respuesta a un comando stats malloc (estadisticas de asignacion de memoria), lo cual permite a atacantes remotos obtener informaci\u00f3n sensible como la localizaci\u00f3n de regiones de memoria, y evitar la protecci\u00f3n ASLR, mediante el env\u00edo de un comando a el demonio del puerto TCP."
    }
  ],
  "id": "CVE-2009-1255",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-04-30T20:30:00.343",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://code.google.com/p/memcachedb/source/detail?r=98"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/54127"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34915"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34932"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/35175"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:105"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.positronsecurity.com/advisories/2009-001.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/503064/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/34756"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id?1022140"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1196"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1197"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50221"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://code.google.com/p/memcachedb/source/detail?r=98"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/54127"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34915"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/34932"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/35175"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:105"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.positronsecurity.com/advisories/2009-001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/503064/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/34756"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id?1022140"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1196"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/1197"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50221"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2009-04-30 20:30
Modified
2025-04-09 00:30
Severity ?
Summary
The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.
References
cve@mitre.orghttp://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98
cve@mitre.orghttp://code.google.com/p/memcachedb/source/detail?r=98Patch
cve@mitre.orghttp://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.cPatch
cve@mitre.orghttp://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40ePatch
cve@mitre.orghttp://memcached.googlecode.com/files/memcached-1.2.8.tar.gz
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/50444
af854a3a-2127-422b-91ae-364da2661108http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98
af854a3a-2127-422b-91ae-364da2661108http://code.google.com/p/memcachedb/source/detail?r=98Patch
af854a3a-2127-422b-91ae-364da2661108http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.cPatch
af854a3a-2127-422b-91ae-364da2661108http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40ePatch
af854a3a-2127-422b-91ae-364da2661108http://memcached.googlecode.com/files/memcached-1.2.8.tar.gz
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/50444
Impacted products
Vendor Product Version
memcachedb memcached 1.2.8


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:memcachedb:memcached:1.2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "45A81180-5F55-4E8B-B4AF-8B646D694945",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon\u0027s TCP port."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n process_stat en Memcached v1.2.8 divulga las estad\u00edsticas de asignaci\u00f3n de memoria en respuesta a un comando stats malloc, lo cual permite a atacantes remotos obtener informaci\u00f3n potencialmente sensible mediante el env\u00edo de este comando al puerto TCP del demonio."
    }
  ],
  "id": "CVE-2009-1494",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-04-30T20:30:00.703",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://code.google.com/p/memcachedb/source/detail?r=98"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://memcached.googlecode.com/files/memcached-1.2.8.tar.gz"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50444"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98\u0026r=98"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://code.google.com/p/memcachedb/source/detail?r=98"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://code.google.com/p/memcachedb/source/diff?spec=svn98\u0026r=98\u0026format=side\u0026path=/trunk/memcachedb.c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://memcached.googlecode.com/files/memcached-1.2.8.tar.gz"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50444"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}