Lucene search

K
freebsdFreeBSDF4BF713F-6AC7-4B76-8980-47BF90C5419F
HistoryOct 31, 2016 - 12:00 a.m.

memcached -- multiple vulnerabilities

2016-10-3100:00:00
vuxml.freebsd.org
12

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.9 High

EPSS

Percentile

98.8%

Cisco Talos reports:

Multiple integer overflow vulnerabilities exist within Memcached
that could be exploited to achieve remote code execution on the
targeted system. These vulnerabilities manifest in various Memcached
functions that are used in inserting, appending, prepending, or
modifying key-value data pairs. Systems which also have Memcached
compiled with support for SASL authentication are also vulnerable to
a third flaw due to how Memcached handles SASL authentication
commands.
An attacker could exploit these vulnerabilities by sending a
specifically crafted Memcached command to the targeted server.
Additionally, these vulnerabilities could also be exploited to leak
sensitive process information which an attacker could use to bypass
common exploitation mitigations, such as ASLR, and can be triggered
multiple times. This enables reliable exploitation which makes these
vulnerabilities severe.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchmemcached< 1.4.33UNKNOWN

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.9 High

EPSS

Percentile

98.8%