PT-2009-1106 · Memcached · Memcached

Ronald Volgers · Published 2009-08-10 · Updated 2014-06-15 · CVE-2009-2415

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions memcached versions prior to 1.4.17

Description The issue concerns multiple vulnerabilities in the memcached package that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, integer overflows in certain versions of memcached can allow remote attackers to execute arbitrary code by exploiting length attributes that trigger heap-based buffer overflows.

Recommendations For versions prior to 1.4.17, update to version 1.4.17 or later to resolve the issue. As a temporary workaround, consider restricting access to the memcached service to minimize the risk of exploitation. Avoid using the vulnerable memcached package until the issue is resolved by updating to a non-vulnerable version.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-09681

CVE-2009-2415

DSA-1853-1

Affected Products

Memcached

References · 14

• https://osv.dev/vulnerability/CVE-2009-2415 · Vendor Advisory
• http://debian.org/security/2009/dsa-1853 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-2415 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2415 · Security Note
• https://bdu.fstec.ru/vul/2015-09681 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-December/msg00836.html · Vendor Advisory
• http://osvdb.org/56906 · Note
• http://secunia.com/advisories/37729 · Note
• http://security.debian.org/pool/updates/main/m/memcached/memcached_1.2.2-1+lenny1.diff.gz · Note
• http://secunia.com/advisories/36133 · Note
• http://securityfocus.com/bid/35989 · Note
• http://security.debian.org/pool/updates/main/m/memcached/memcached_1.1.12-1+etch1.diff.gz · Note
• http://security.gentoo.org/glsa/glsa-201406-13.xml · Note