Stack-based buffer overflow in Redis - CVE-2019-10193

Vulnerability identifier: #VU19168

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-10193

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing Redis hyperloglog data structure. A remote attacker can carefully corrupt hyperloglog using the SETRANGE command, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Redis
Gentoo Linux
Red Hat Enterprise Linux Server
openEuler
redis (Debian package)
redis (Alpine package)
redis
redis-debugsource
redis-debuginfo
rh-redis5-redis (Red Hat package)
Oracle Communications Operations Monitor

Install updates from vendor's website.

Redis - addressed in versions 3.2.13, 4.0.14, 5.0.4
redis (Debian package) - update to 3:3.2.6-3+deb9u3
redis (Alpine package) - update to 4.0.14-r0
redis - update to 4.0.11-11
redis-debugsource - update to 4.0.11-11
redis-debuginfo - update to 4.0.11-11
rh-redis5-redis (Red Hat package) - update to 5.0.5-1.el7

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10193
• https://raw.githubusercontent.com/antirez/redis/3.2/00-RELEASENOTES
• https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES
• https://raw.githubusercontent.com/antirez/redis/5.0/00-RELEASENOTES
• https://seclists.org/bugtraq/2019/Jul/19

• Multiple vulnerabilities in Redis
• Debian update for redis
• Red Hat update for 5
• Gentoo update for Redis
• Multiple vulnerabilities in Oracle Communications Operations Monitor
• Stack-based buffer overflow in redis (Alpine package)
• Red Hat Software Collections update for rh-redis5-redis
• openEuler 20.03 LTS update for redis