PT-2016-7496 · Redis · Redis
Cory Duplantis
·
Published
2016-10-28
·
Updated
2024-06-15
·
CVE-2016-8339
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Redis versions 3.2.x prior to 3.2.4
Description
A buffer overflow in Redis causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the
client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.Recommendations
For Redis versions 3.2.x prior to 3.2.4, update to version 3.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the CONFIG SET command to minimize the risk of exploitation. Avoid using the
client-output-buffer-limit option in the CONFIG SET command until the issue is resolved.Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Redis