Heap-based buffer overflow in memcached - CVE-2016-8705

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU4139

Heap-based buffer overflow in memcached - CVE-2016-8705

Published: October 1, 2016 / Updated: April 2, 2018


Vulnerability identifier: #VU4139
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8705
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the process_bin_update() function due to integer overflow. A remote attacker can send specially crafted Memcached binary protocol commands, trigger heap-based buffer overflow and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Affected software

memcached
Arch Linux
Debian Linux
Gentoo Linux
Amazon Linux AMI
Ubuntu
Fedora
memcached (Alpine package)
memcached

How to mitigate CVE-2016-8705

Install update from vendor's website.

memcached (Alpine package) - update to 1.4.33-r0
memcached - addressed in versions 1.4.17-5.fc23, 1.4.25-2.fc24, 1.4.33-1.fc25, 1.4.39-1.fc25, 1.4.39-1.fc26

External References

Related Security Bulletins