PT-2016-3851 · Redis+1 · Redis+1
Kaeso
+1
·
Publicado
2015-12-03
·
Atualizado
2026-05-18
·
CVE-2015-8080
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions 2.8.x through 2.8.23
Redis versions 3.0.x through 3.0.5
Description
The issue is related to an integer overflow in the getnum function in lua struct.c. This allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service, including memory corruption and application crash, or possibly bypass intended sandbox restrictions. The attack is triggered by a large number, which causes a stack-based buffer overflow.
Recommendations
For Redis versions 2.8.x through 2.8.23, update to version 2.8.24 or later.
For Redis versions 3.0.x through 3.0.5, update to version 3.0.6 or later.
Exploit
Correção
DoS
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Redis